PT-2024-19967 · National Instruments · Labview

06Fe5Fd2Bc53027C4A3B7E395Af0B850E7B8A044 · Published 2024-03-11 · Updated 2024-10-10 · CVE-2024-23612

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions LabVIEW versions 2024 Q1 and prior

Description An improper error handling issue in LabVIEW may result in remote code execution. Successful exploitation requires an attacker to provide a user with a specially crafted VI.

Recommendations For versions 2024 Q1 and prior, consider disabling the ability to open specially crafted VIs until a patch is available. Restrict access to the VI file parsing functionality to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-1285

Related Identifiers

CVE-2024-23612

ZDI-24-289

Affected Products

Labview

References · 8

• https://zerodayinitiative.com/advisories/ZDI-24-289 · Security Note
• https://osv.dev/vulnerability/CVE-2024-23612 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-23612 · Security Note
• https://twitter.com/cracbot/status/1767602878351352192 · Twitter Post
• https://t.me/cvenotify/73558 · Telegram Post
• https://ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/improper-error-handling-issues-in-labview.html · Note
• https://twitter.com/CVEnew/status/1767210788945858623 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1767263059481960869 · Twitter Post