« Volver al listado

CVE-2024-23612

Estado: AnalizadaAlta (7.8)—

An improper error handling vulnerability in LabVIEW may result in remote code execution. Successful exploitation requires an attacker to provide a user with a specially crafted VI. This vulnerability affects LabVIEW 2024 Q1 and prior versions.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

NI — Labview

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-23612",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-23612",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-03-11T17:03:56.780213Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security@ni.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.8,
          "attackVector": "LOCAL",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 1.8
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.8,
          "attackVector": "LOCAL",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 1.8
      }
    ]
  },
  "affected": [
    {
      "source": "security@ni.com",
      "affectedData": [
        {
          "vendor": "NI",
          "product": "LabVIEW",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "versionType": "custom",
              "lessThanOrEqual": "2024 Q1"
            }
          ],
          "platforms": [
            "Windows",
            "Linux"
          ],
          "defaultStatus": "unaffected"
        }
      ]
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:ni:labview:*:*:*:*:*:*:*:*"
          ],
          "vendor": "ni",
          "product": "labview",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "versionType": "custom",
              "lessThanOrEqual": "2024_q1"
            }
          ],
          "defaultStatus": "unknown"
        }
      ]
    }
  ],
  "published": "2024-03-11T16:15:08.743",
  "references": [
    {
      "url": "https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/improper-error-handling-issues-in-labview.html",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "security@ni.com"
    },
    {
      "url": "https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/improper-error-handling-issues-in-labview.html",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security@ni.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-1285"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-noinfo"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "An improper error handling vulnerability in LabVIEW may result in remote code execution.  Successful exploitation requires an attacker to provide a user with a specially crafted VI.  This vulnerability affects LabVIEW 2024 Q1 and prior versions."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad de manejo incorrecto de errores en LabVIEW puede resultar en la ejecución remota de código. La explotación exitosa requiere que un atacante proporcione al usuario un VI especialmente manipulado. Esta vulnerabilidad afecta a LabVIEW 2024 Q1 y versiones anteriores."
    }
  ],
  "lastModified": "2026-06-17T07:13:13.873",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:ni:labview:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E9BBCA76-7B4C-4CC5-A782-489CA4223C04",
              "versionEndIncluding": "2020"
            },
            {
              "criteria": "cpe:2.3:a:ni:labview:2021:-:*:*:-:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F46539B2-9084-45E3-B9D6-447C9E002C0C"
            },
            {
              "criteria": "cpe:2.3:a:ni:labview:2021:sp1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BF28259A-30A6-4BB1-B262-A006AB74AFFA"
            },
            {
              "criteria": "cpe:2.3:a:ni:labview:2022:q1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4D12D6CF-802F-47BA-ADF9-9E52C071BD7F"
            },
            {
              "criteria": "cpe:2.3:a:ni:labview:2022:q3:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "340F61E5-D1ED-4C29-A894-8BC5C5B90ACE"
            },
            {
              "criteria": "cpe:2.3:a:ni:labview:2023:q1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D7DD2022-CFB7-4F38-B459-C1AFB55B5B68"
            },
            {
              "criteria": "cpe:2.3:a:ni:labview:2023:q3:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "18AB0B07-72FE-4861-B69D-AD2E87C5382E"
            },
            {
              "criteria": "cpe:2.3:a:ni:labview:2023:q3_patch1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "91928C9C-F094-4EE4-9FBE-2B7956D68E6F"
            },
            {
              "criteria": "cpe:2.3:a:ni:labview:2023:q3_patch2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "044C4B51-C641-41F2-ACA0-834C99D63285"
            },
            {
              "criteria": "cpe:2.3:a:ni:labview:2024:q1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7753CCDF-BAF8-4F91-B85B-EBB2B88F6F30"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security@ni.com"
}