« Volver al listado

CVE-2024-1155

Estado: AnalizadaAlta (7.8)—

Incorrect permissions in the installation directories for shared SystemLink Elixir based services may allow an authenticated user to potentially enable escalation of privilege via local access.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (8)

Emerson — Data Record ADEmerson — FlexloggerEmerson — G WEB Development SoftwareEmerson — Labview NXGEmerson — Specification Compliance ManagerEmerson — Static Test Software SuiteEmerson — STS Software BundleEmerson — Systemlink Server

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-1155",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-1155",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-02-20T18:08:51.196119Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security@ni.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.8,
          "attackVector": "LOCAL",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 1.8
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.8,
          "attackVector": "LOCAL",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 1.8
      }
    ]
  },
  "affected": [
    {
      "source": "security@ni.com",
      "affectedData": [
        {
          "vendor": "NI",
          "product": "SystemLink Server",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "versionType": "custom",
              "lessThanOrEqual": "2023 Q3"
            }
          ],
          "platforms": [
            "Windows"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "NI",
          "product": "FlexLogger",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "versionType": "custom",
              "lessThanOrEqual": "2022 Q3"
            }
          ],
          "platforms": [
            "Windows"
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2024-02-20T15:15:09.703",
  "references": [
    {
      "url": "https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/incorrect-permissions-for-shared-systemlink-elixir-based-service.html",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ],
      "source": "security@ni.com"
    },
    {
      "url": "https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/incorrect-permissions-for-shared-systemlink-elixir-based-service.html",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security@ni.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-276"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-863"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Incorrect permissions in the installation directories for shared SystemLink Elixir based services may allow an authenticated user to potentially enable escalation of privilege via local access. \n"
    },
    {
      "lang": "es",
      "value": "Los permisos incorrectos en los directorios de instalación para los servicios compartidos basados en SystemLink Elixir pueden permitir que un usuario autenticado habilite potencialmente la escalada de privilegios a través del acceso local."
    }
  ],
  "lastModified": "2026-06-17T07:03:35.727",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:emerson:data_record_ad:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2267E001-7C8A-4E3C-BAA3-C4108CDC2C11",
              "versionEndIncluding": "2.0.1"
            },
            {
              "criteria": "cpe:2.3:a:emerson:flexlogger:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A05CEECE-4F09-4875-97F5-D419044299B8",
              "versionEndIncluding": "2022_q3"
            },
            {
              "criteria": "cpe:2.3:a:emerson:g_web_development_software:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1C4008CF-D7BB-4400-AF25-69A468E0274F",
              "versionEndIncluding": "2022_q3"
            },
            {
              "criteria": "cpe:2.3:a:emerson:labview_nxg:5.1:*:*:*:community:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E84E23D5-04EB-4B73-B335-AD1F9ECA6166"
            },
            {
              "criteria": "cpe:2.3:a:emerson:labview_nxg:5.1:*:*:*:real-time_module:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "25474D7C-8523-49BF-8D83-5D82A0D95FD0"
            },
            {
              "criteria": "cpe:2.3:a:emerson:labview_nxg:5.1:*:*:*:web_module:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "06AE0E0E-8E3C-416F-97EC-308FB2953B56"
            },
            {
              "criteria": "cpe:2.3:a:emerson:specification_compliance_manager:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "18B58D78-41AA-484A-A184-DFA999ED504B",
              "versionEndIncluding": "2023_q4"
            },
            {
              "criteria": "cpe:2.3:a:emerson:static_test_software_suite:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "338BAA7F-884C-41D8-B131-9E2C2FD46DC6",
              "versionEndIncluding": "1.2"
            },
            {
              "criteria": "cpe:2.3:a:emerson:sts_software_bundle:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B018440C-809C-4E30-9A08-AAF79D7D280E",
              "versionEndIncluding": "21.0"
            },
            {
              "criteria": "cpe:2.3:a:emerson:systemlink_server:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "95CF6EFB-FED4-428A-8CE5-AAE9D12A64FB",
              "versionEndExcluding": "2024_q1"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security@ni.com"
}