« Volver al listado

CVE-2024-4044

Estado: AplazadaAlta (7.8)—

A deserialization of untrusted data vulnerability exists in common code used by FlexLogger and InstrumentStudio that may result in remote code execution. Successful exploitation requires an attacker to get a user to open a specially crafted project file. This vulnerability affects NI FlexLogger 2024 Q1 and prior versions as well as NI InstrumentStudio 2024 Q1 and prior versions.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (2)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

NI — FlexloggerAINI — InstrumentstudioAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-4044",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-4044",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-05-11T17:25:10.120453Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security@ni.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.8,
          "attackVector": "LOCAL",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 1.8
      }
    ]
  },
  "affected": [
    {
      "source": "security@ni.com",
      "affectedData": [
        {
          "vendor": "NI",
          "product": "FlexLogger",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "versionType": "custom",
              "lessThanOrEqual": "24.1"
            }
          ],
          "platforms": [
            "Windows"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "NI",
          "product": "InstrumentStudio",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "versionType": "custom",
              "lessThanOrEqual": "24.1"
            }
          ],
          "platforms": [
            "Windows"
          ],
          "defaultStatus": "unaffected"
        }
      ]
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:ni:flexlogger:2024:q1:*:*:*:*:*:*"
          ],
          "vendor": "ni",
          "product": "flexlogger",
          "versions": [
            {
              "status": "affected",
              "version": "2024",
              "versionType": "custom",
              "lessThanOrEqual": "24.1"
            }
          ],
          "defaultStatus": "unaffected"
        },
        {
          "cpes": [
            "cpe:2.3:a:ni:instrumentstudio:2024:q1:*:*:*:*:*:*"
          ],
          "vendor": "ni",
          "product": "instrumentstudio",
          "versions": [
            {
              "status": "affected",
              "version": "2024",
              "versionType": "custom",
              "lessThanOrEqual": "24.1"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2024-05-14T15:42:45.640",
  "references": [
    {
      "url": "https://ni.com/r/CVE-2024-4044",
      "source": "security@ni.com"
    },
    {
      "url": "https://ni.com/r/CVE-2024-4044",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security@ni.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-502"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "A deserialization of untrusted data vulnerability exists in common code used by FlexLogger and InstrumentStudio that may result in remote code execution.  Successful exploitation requires an attacker to get a user to open a specially crafted project file.  This vulnerability affects NI FlexLogger 2024 Q1 and prior versions as well as NI InstrumentStudio 2024 Q1 and prior versions.\n"
    },
    {
      "lang": "es",
      "value": "Existe una vulnerabilidad de deserialización de datos no confiables en el código común utilizado por FlexLogger e InstrumentStudio que puede resultar en la ejecución remota de código. La explotación exitosa requiere que un atacante consiga que un usuario abra un archivo de proyecto especialmente manipulado. Esta vulnerabilidad afecta a NI FlexLogger 2024 Q1 y versiones anteriores, así como a NI InstrumentStudio 2024 Q1 y versiones anteriores."
    }
  ],
  "lastModified": "2026-06-17T08:01:00.563",
  "sourceIdentifier": "security@ni.com"
}