PT-2023-29793 · National Instruments · Ni System Configuration

Published 2023-10-18 · Updated 2023-10-28 · CVE-2023-4601

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions NI System Configuration versions prior to 2023 Q3

Description A stack-based buffer overflow vulnerability exists in NI System Configuration that could result in information disclosure and/or arbitrary code execution. Successful exploitation requires that an attacker can provide a specially crafted response.

Recommendations For versions prior to 2023 Q3, update to a version newer than 2023 Q3 to resolve the issue. As a temporary workaround, consider restricting access to the NI System Configuration to minimize the risk of exploitation.

Fix

Stack Overflow

Memory Corruption

Weakness Enumeration

CWE-121

CWE-787

Related Identifiers

CVE-2023-4601

ZDI-23-1568

Affected Products

Ni System Configuration

References · 9

• https://ni.com/en/support/documentation/supplemental/23/stack-based-buffer-overflow-in-ni-system-configuration.html · Vendor Advisory
• https://zerodayinitiative.com/advisories/ZDI-23-1568 · Security Note
• https://osv.dev/vulnerability/CVE-2023-4601 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-4601 · Security Note
• https://twitter.com/TheZDIBugs/status/1715018557757506031 · Twitter Post
• https://t.me/cibsecurity/72538 · Telegram Post
• https://twitter.com/cracbot/status/1715064573454164263 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1714770037314126091 · Twitter Post
• https://twitter.com/CVEnew/status/1714724140744053074 · Twitter Post