PT-2026-50901 · Ni · Ni Instrumentstudio+1

Sebasteuo · Published 2026-06-19 · Updated 2026-06-20 · CVE-2026-9142

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions NI grpc-device versions prior to 2.17.0

Description Insecure default credentials exist when TLS configuration is absent and the server is bound beyond the loopback interface. This allows an unauthenticated user on the local network to gain access to the server, potentially leading to remote code execution (RCE), which is the ability to execute arbitrary commands on a remote machine.

Recommendations Update to a version later than 2.17.0.

Fix

RCE

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

CVE-2026-9142

Affected Products

Ni Instrumentstudio

Grpc-Device

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2026-9142 · Security Note
• https://ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/2026/multiple-vulnerabilities-in-ni-grpc-device-server.html · Vendor Advisory
• https://github.com/ni/grpc-device/security/advisories/GHSA-fhhw-37q8-6562 · Note
• https://twitter.com/YourAnon_irc/status/2068414374562173162 · Twitter Post
• https://twitter.com/HugoValters/status/2068023585885552854 · Twitter Post