CVE-2024-6791highCWE-22

Directory Path Traversal Vulnerability in NI VeriStand with vsmodel Files

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 7.8epss 0.5%

exploitation probability

0.5%top 61% of all CVEs

observed exploitation

nono source reports it

In short

NI VeriStand has a flaw that lets attackers run malicious code on your computer if you open a specially crafted .vsmodel file. This happens because the program doesn't properly check file paths, allowing an attacker to access unauthorized locations on your system.

Technical detail

A path traversal vulnerability (CWE-22) in NI VeriStand's vsmodel file loader allows an attacker to execute arbitrary code through a crafted .vsmodel file. The attack vector is user interaction (opening the malicious file); successful exploitation requires social engineering to trick a user into opening the file, with impact including remote code execution on the affected system running VeriStand 2024 Q2 or earlier.

Summary generated and translated by AI from the official description.

A directory path traversal vulnerability exists when loading a vsmodel file in NI VeriStand that may result in remote code execution. Successful exploitation requires an attacker to get a user to open a specially crafted .vsmodel file. This vulnerability affects VeriStand 2024 Q2 and prior versions.

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected products

NI · VeriStand

References

https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/directory-path-traversal-vulnerability-in-ni-veristand-with-vsmodel-files.html