CVE-2024-12742highCWE-502

CVE-2024-12742: high-severity vulnerability in NI G Web Development Software

Deserialization of Untrusted Data Vulnerability in NI G Web Development Software

Published

Follow this CVE+ Monitor G Web Development

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 8.4epss 5.5%
In short

A flaw in NI G Web Development Software allows attackers to run malicious code on a user's computer if they trick the user into opening a specially crafted project file. This happens because the software unsafely processes data from untrusted files.

Technical detail

This CWE-502 deserialization vulnerability in NI G Web Development Software (v2022 Q3 and earlier) enables arbitrary code execution through malicious project files. Attack vector requires user interaction (opening a crafted file); once deserialized without proper validation, untrusted data can instantiate arbitrary objects leading to RCE with the privileges of the affected user.

Summary generated and translated by AI from the official description.
A deserialization of untrusted data vulnerability exists in NI G Web Development Software that may result in arbitrary code execution.  Successful exploitation requires an attacker to get a user to open a specially crafted project file.  This vulnerability affects G Web Development Software 2022 Q3 and prior versions.
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/AU:N
Affected products
NI · G Web Development Software