PT-2024-17081 · National Instruments · Ni Flexlogger

06Fe5Fd2Bc53027C4A3B7E395Af0B850E7B8A044 · Published 2024-02-20 · Updated 2024-02-28 · CVE-2024-1155

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions NI FlexLogger versions (affected versions not specified)

Description The issue is related to incorrect permissions in the installation directories for shared SystemLink Elixir based services. This may allow an authenticated user to potentially enable escalation of privilege via local access.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Incorrect Authorization

Incorrect Default Permissions

Weakness Enumeration

CWE-863

CWE-276

Related Identifiers

CVE-2024-1155

ZDI-24-209

ZDI-24-210

ZDI-24-211

ZDI-24-212

ZDI-24-213

Affected Products

Ni Flexlogger

References · 11

• https://nvd.nist.gov/vuln/detail/CVE-2024-1155 · Security Note
• https://osv.dev/vulnerability/CVE-2024-1155 · Vendor Advisory
• https://ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/incorrect-permissions-for-shared-systemlink-elixir-based-service.html · Vendor Advisory
• https://zerodayinitiative.com/advisories/ZDI-24-209 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-24-210 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-24-213 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-24-211 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-24-212 · Security Note
• https://t.me/cvenotify/71985 · Telegram Post
• https://twitter.com/CVEnew/status/1759954212937404652 · Twitter Post
• https://twitter.com/cracbot/status/1760182633471021488 · Twitter Post