CVE-2024-6793 - CVE House

Back to Database

Status published Critical CVE-2024-6793

Deserialization of Untrusted Data in NI VeriStand DataLogging Server

9.8 CVSS

Vulnerability Description

A deserialization of untrusted data vulnerability exists in NI VeriStand DataLogging Server that may result in remote code execution. Successful exploitation requires an attacker to send a specially crafted message. These vulnerabilities affect NI VeriStand 2024 Q2 and prior versions.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-6793

Check My Exposure

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

kimiya working with Trend Micro Zero Day Initiative

References

https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/deserialization-of-untrusted-data-vulnerabilities-in-ni-veristand.html

More from NI

View All →

Memory Corruption Issue in NI LabVIEW due to improper error handling

Missing input check in lvpict.cpp used in NI LabVIEW

Code Injection Vulnerability in NI LabVIEW when using CIN nodes

Out of Bounds Read in DefaultFontOptions() in NI Circuit Design Suite

Memory Corruption issue in XML_Serialize() in NI Circuit Design Suite

Affected Vendor

NI

View all reports →

Affected Software

VeriStand

Vulnerable Versions:

0

Timeline

Official Publish: July 22nd, 2024

Last Modified: August 1st, 2024

Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application

T1059 Command and Scripting Interpreter

T1505.003 Web Shell

T1105 Ingress Tool Transfer

Command and Control

T1068 Exploitation for Privilege Escalation

Privilege Escalation