PT-2024-17725 · National Instruments · Ni Daqexpress

Published 2024-12-18 · Updated 2025-03-06 · CVE-2024-12741

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions NI DAQExpress versions 5.1 and prior

Description A deserialization of untrusted data issue exists that may result in remote code execution. Successful exploitation requires an attacker to get a user to open a specially crafted project file.

Recommendations For NI DAQExpress versions 5.1 and prior, consider avoiding the use of untrusted project files to minimize the risk of exploitation, as the product is end-of-life and will not receive updates. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2024-12741

ZDI-25-105

Affected Products

Ni Daqexpress

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2024-12741 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-25-105 · Security Note
• https://knowledge.ni.com/KnowledgeArticleDetails?id=kA00Z000000kFD7SAM&l=en-US · Note
• https://twitter.com/int20z/status/1897468249513853301 · Twitter Post
• https://twitter.com/CVEnew/status/1869466912259821894 · Twitter Post
• https://t.me/cvedetector/13249 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1869573216953340405 · Twitter Post