PT-2023-29652 · National Instruments · Ni-Measurementlink-Service

Published 2023-10-05 · Updated 2023-10-12 · CVE-2023-4570

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ni-measurementlink-service versions 1.1.0 and earlier

Description An improper access restriction in NI MeasurementLink Python services could allow an attacker on an adjacent network to reach services exposed on localhost. These services were previously thought to be unreachable outside of the node.

Recommendations For versions 1.1.0 and earlier, upgrade to version 1.1.1 or later of the ni-measurementlink-service Python package to resolve the issue. As a temporary workaround, consider restricting access to the services exposed on localhost to minimize the risk of exploitation.

Fix

Weakness Enumeration

CWE-420

Related Identifiers

CVE-2023-4570

GHSA-3F48-9J7Q-Q2GV

Affected Products

Ni-Measurementlink-Service

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2023-4570 · Security Note
• https://ni.com/en/support/documentation/supplemental/23/improper-restriction-in-ni-measurementlink-python-services.html · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-3f48-9j7q-q2gv · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-4570 · Vendor Advisory
• https://github.com/ni/measurementlink-python/commit/3e9d45147befc9a151fca5582c64fa77c7ba1980 · Note
• https://github.com/ni/measurementlink-python · Note
• https://github.com/ni/measurementlink-python/commit/d2c73b1e0252081e1b89767aa916d73772d04dd9 · Note
• https://github.com/ni/measurementlink-python/security/advisories/GHSA-3f48-9j7q-q2gv · Note
• https://twitter.com/VulmonFeeds/status/1710005387192152321 · Twitter Post
• https://twitter.com/CVEnew/status/1709956799913452005 · Twitter Post