CVE-2026-9142

Katalog CVE

CVSS 9.1 · Critical EPSS 0,43%

Kerentanan Missing Authentication for Critical Function pada ni instrumentstudio, ni grpc device server. Skor CVSS 3.1 9.1 (Critical) menurut ni.com.

Deskripsi (NVD)

There is an insecure default credentials vulnerability in NI grpc-device when TLS configuration is not present and the server is bound beyond loopback.  This may allow an unauthenticated user access to the server on the local network.  This affects NI grpc-device 2.17.0 and prior versions.

Rincian

Terbit di NVD

19 Juni 2026

Terakhir diubah

25 Juni 2026

Status NVD

Analyzed

CVSS 3.1

9.1 (Critical), sumber ni.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-306: Missing Authentication for Critical Function

EPSS (30 hari)

0,43% peluang dieksploitasi; lebih tinggi dari 35,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/ni/grpc-device/security/advisories/GHSA-fhhw-37q8-6562 advisory vendor
• https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/2026/multiple-v... advisory vendor