CVE-2026-9142criticalCWE-306

Insecure Default Credentials vulnerability in NI grpc-device when TLS configuration is not present

28Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 9.3epss 0.4%

probabilidade de exploração

0.4%top 64% das CVEs

exploração observada

nãonenhuma fonte reporta

There is an insecure default credentials vulnerability in NI grpc-device when TLS configuration is not present and the server is bound beyond loopback. This may allow an unauthenticated user access to the server on the local network. This affects NI grpc-device 2.17.0 and prior versions.

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Produtos afetados

NI · grpc-device NI · InstrumentStudio

Referências

https://github.com/ni/grpc-device/security/advisories/GHSA-fhhw-37q8-6562 https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/2026/multiple-vulnerabilities-in-ni-grpc-device-server.html