CVE-2024-1155

Published: Feb 20, 2024Modified: Jun 17, 2026

7.8

Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability: 1.8 / Impact: 5.9

Source: NVD

Description

Incorrect permissions in the installation directories for shared SystemLink Elixir based services may allow an authenticated user to potentially enable escalation of privilege via local access.

Affected (10)

Products: Emerson: Data Record Ad, Flexlogger, G Web Development Software, Labview Nxg, Specification Compliance Manager, Static Test Software Suite, Sts Software Bundle, Systemlink Server

Emerson

8 products

Data Record Ad

Flexlogger

G Web Development Software

Labview Nxg

Specification Compliance Manager

Static Test Software Suite

Sts Software Bundle

Systemlink Server

Configuration A

10 vulnerable

Vulnerable Software	Affected Versions
Emerson Data Record Ad	version ≤ 2.0.1
Emerson Flexlogger	version ≤ 2022_q3
Emerson G Web Development Software	version ≤ 2022_q3
Emerson Labview Nxg	Version 5.1
Emerson Labview Nxg	Version 5.1
Emerson Labview Nxg	Version 5.1
Emerson Specification Compliance Manager	version ≤ 2023_q4
Emerson Static Test Software Suite	version ≤ 1.2
Emerson Sts Software Bundle	version ≤ 21.0
Emerson Systemlink Server	version < 2024_q1

Related CWEs

CWE-276

Incorrect Default Permissions

During installation, installed file permissions are set to allow anyone to modify those files.

CWE-863

Incorrect Authorization

The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.

References (2)

https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/incorrect-permissions-for-shared-systemlink-elixir-based-service.html

Source: security@ni.com

ExploitVendor Advisory

https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/incorrect-permissions-for-shared-systemlink-elixir-based-service.html

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitVendor Advisory

Timeline

No history available yet.