« Volver al listado

CVE-2024-4079

Estado: ModificadaAlta (7.8)—

An out of bounds read due to a missing bounds check in LabVIEW may disclose information or result in arbitrary code execution. Successful exploitation requires an attacker to provide a user with a specially crafted VI. This vulnerability affects LabVIEW 2024 Q1 and prior versions.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

NI — Labview

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-4079",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-4079",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-07-23T14:10:10.492631Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security@ni.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.8,
          "attackVector": "LOCAL",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 1.8
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.8,
          "attackVector": "LOCAL",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 1.8
      }
    ]
  },
  "affected": [
    {
      "source": "security@ni.com",
      "affectedData": [
        {
          "vendor": "NI",
          "product": "LabVIEW",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "versionType": "semver",
              "lessThanOrEqual": "24.1"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:ni:labview:*:*:*:*:*:*:*:*"
          ],
          "vendor": "ni",
          "product": "labview",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "versionType": "semver",
              "lessThanOrEqual": "24.1"
            }
          ],
          "defaultStatus": "unknown"
        }
      ]
    }
  ],
  "published": "2024-07-23T14:15:14.353",
  "references": [
    {
      "url": "https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/out-of-bounds-read-due-to-missing-bounds-check-in-labview.html",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "security@ni.com"
    },
    {
      "url": "https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/out-of-bounds-read-due-to-missing-bounds-check-in-labview.html",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security@ni.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-125"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-125"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "An out of bounds read due to a missing bounds check in LabVIEW may disclose information or result in arbitrary code execution.  Successful exploitation requires an attacker to provide a user with a specially crafted VI.  This vulnerability affects LabVIEW 2024 Q1 and prior versions."
    },
    {
      "lang": "es",
      "value": "Una lectura fuera de los límites debido a una verificación de límites faltantes en LabVIEW puede revelar información o resultar en la ejecución de código arbitrario. La explotación exitosa requiere que un atacante proporcione al usuario un VI especialmente manipulado. Esta vulnerabilidad afecta a LabVIEW 2024 Q1 y versiones anteriores."
    }
  ],
  "lastModified": "2026-06-17T08:01:04.020",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:ni:labview:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E9BBCA76-7B4C-4CC5-A782-489CA4223C04",
              "versionEndIncluding": "2020"
            },
            {
              "criteria": "cpe:2.3:a:ni:labview:2021:-:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9F184512-5D11-47F4-8555-EA6FF93C106F"
            },
            {
              "criteria": "cpe:2.3:a:ni:labview:2021:sp1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BF28259A-30A6-4BB1-B262-A006AB74AFFA"
            },
            {
              "criteria": "cpe:2.3:a:ni:labview:2022:q1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4D12D6CF-802F-47BA-ADF9-9E52C071BD7F"
            },
            {
              "criteria": "cpe:2.3:a:ni:labview:2022:q3:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "340F61E5-D1ED-4C29-A894-8BC5C5B90ACE"
            },
            {
              "criteria": "cpe:2.3:a:ni:labview:2023:q1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D7DD2022-CFB7-4F38-B459-C1AFB55B5B68"
            },
            {
              "criteria": "cpe:2.3:a:ni:labview:2023:q3:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "18AB0B07-72FE-4861-B69D-AD2E87C5382E"
            },
            {
              "criteria": "cpe:2.3:a:ni:labview:2023:q3_patch2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "044C4B51-C641-41F2-ACA0-834C99D63285"
            },
            {
              "criteria": "cpe:2.3:a:ni:labview:2024:q1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7753CCDF-BAF8-4F91-B85B-EBB2B88F6F30"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security@ni.com"
}