Lucene search

NICVE-2024-4079

HistoryJul 23, 2024 - 2:15 p.m.

CVE-2024-4079

2024-07-2314:15:14

CWE-125

web.nvd.nist.gov

labview

out of bounds read

vulnerability

information disclosure

arbitrary code execution

exploitation

specially crafted vi

software security

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS

0.001

Percentile

22.3%

JSON

An out of bounds read due to a missing bounds check in LabVIEW may disclose information or result in arbitrary code execution. Successful exploitation requires an attacker to provide a user with a specially crafted VI. This vulnerability affects LabVIEW 2024 Q1 and prior versions.

Affected configurations

Nvd

Node

nilabviewRange≤2020

nilabviewMatch2021-

nilabviewMatch2021sp1

nilabviewMatch2022q1

nilabviewMatch2022q3

nilabviewMatch2023q1

nilabviewMatch2023q3

nilabviewMatch2023q3_patch2

nilabviewMatch2024q1

VendorProductVersionCPE
nilabview*cpe:2.3:a:ni:labview:*:*:*:*:*:*:*:*
nilabview2021cpe:2.3:a:ni:labview:2021:-:*:*:*:*:*:*
nilabview2021cpe:2.3:a:ni:labview:2021:sp1:*:*:*:*:*:*
nilabview2022cpe:2.3:a:ni:labview:2022:q1:*:*:*:*:*:*
nilabview2022cpe:2.3:a:ni:labview:2022:q3:*:*:*:*:*:*
nilabview2023cpe:2.3:a:ni:labview:2023:q1:*:*:*:*:*:*
nilabview2023cpe:2.3:a:ni:labview:2023:q3:*:*:*:*:*:*
nilabview2023cpe:2.3:a:ni:labview:2023:q3_patch2:*:*:*:*:*:*
nilabview2024cpe:2.3:a:ni:labview:2024:q1:*:*:*:*:*:*

Vendor	Product	Version	CPE
ni	labview	*	cpe:2.3:a:ni:labview::::::::
ni	labview	2021	cpe:2.3:a:ni:labview:2021:-::::::
ni	labview	2021	cpe:2.3:a:ni:labview:2021:sp1::::::
ni	labview	2022	cpe:2.3:a:ni:labview:2022:q1::::::
ni	labview	2022	cpe:2.3:a:ni:labview:2022:q3::::::
ni	labview	2023	cpe:2.3:a:ni:labview:2023:q1::::::
ni	labview	2023	cpe:2.3:a:ni:labview:2023:q3::::::
ni	labview	2023	cpe:2.3:a:ni:labview:2023:q3_patch2::::::
ni	labview	2024	cpe:2.3:a:ni:labview:2024:q1::::::

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "LabVIEW",
    "vendor": "NI",
    "versions": [
      {
        "lessThanOrEqual": "24.1",
        "status": "affected",
        "version": "0",
        "versionType": "semver"
      }
    ]
  }
]

References

www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/out-of-bounds-read-due-to-missing-bounds-check-in-labview.html

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS

0.001

Percentile

22.3%

JSON

Related for CVE-2024-4079