PT-2024-19963 · National Instruments · Labview

06Fe5Fd2Bc53027C4A3B7E395Af0B850E7B8A044 · Published 2024-03-11 · Updated 2024-10-10 · CVE-2024-23609

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions LabVIEW versions prior to 2024 Q1

Description An improper error handling issue may result in remote code execution. Successful exploitation requires an attacker to provide a user with a specially crafted VI.

Recommendations For versions prior to 2024 Q1, update to a version newer than 2024 Q1 to resolve the issue. As a temporary workaround, consider restricting the use of specially crafted VIs to minimize the risk of exploitation.

Fix

Weakness Enumeration

CWE-1285

Related Identifiers

CVE-2024-23609

ZDI-24-285

ZDI-24-290

Affected Products

Labview

References · 9

• https://zerodayinitiative.com/advisories/ZDI-24-285 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-24-290 · Security Note
• https://osv.dev/vulnerability/CVE-2024-23609 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-23609 · Security Note
• https://ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/improper-error-handling-issues-in-labview.html · Note
• https://twitter.com/CVEnew/status/1767210790191566895 · Twitter Post
• https://twitter.com/cracbot/status/1767602870965162269 · Twitter Post
• https://t.me/cvenotify/73555 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1767263312411029874 · Twitter Post