CVE-2026-9142

9.1 Critique

Publiée le 19/06/2026 à 16:16 · Modifiée le 25/06/2026 à 16:40 · Analysée par le NVD · Source : security@ni.com

Description

There is an insecure default credentials vulnerability in NI grpc-device when TLS configuration is not present and the server is bound beyond loopback. This may allow an unauthenticated user access to the server on the local network. This affects NI grpc-device 2.17.0 and prior versions.

Traduire en français

Produits concernés

NI grpc-device
NI InstrumentStudio
Ni ni grpc device server

Scores CVSS

Version	Score	Source	Vecteur
4.0	9.3 Critique	security@ni.com	`CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X`
3.1	9.1 Critique	security@ni.com	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N`

Faiblesses (CWE)

CWE-306

Références

https://github.com/ni/grpc-device/security/advisories/GHSA-fhhw-37q8-6562 Vendor Advisory
https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/2026/multiple-vulnerabilities-in-ni-grpc-device-server.html Vendor Advisory

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories