CVE-2024-1156

Published: Feb 20, 2024Modified: Jun 17, 2026

7.8

Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability: 1.8 / Impact: 5.9

Source: NVD

Description

Incorrect directory permissions for the shared NI RabbitMQ service may allow a local authenticated user to read RabbitMQ configuration information and potentially enable escalation of privileges.

Affected (10)

Products: Emerson: Data Record Ad, Flexlogger, G Web Development Software, Labview Nxg, Specification Compliance Manager, Static Test Software Suite, Sts Software Bundle, Systemlink Server

Emerson

8 products

Data Record Ad

Flexlogger

G Web Development Software

Labview Nxg

Specification Compliance Manager

Static Test Software Suite

Sts Software Bundle

Systemlink Server

Configuration A

10 vulnerable

Vulnerable Software	Affected Versions
Emerson Data Record Ad	Up to 2.0.1
Emerson Flexlogger	Up to 2022_q3
Emerson G Web Development Software	Up to 2022_q3
Emerson Labview Nxg	Version 5.1
Emerson Labview Nxg	Version 5.1
Emerson Labview Nxg	Version 5.1
Emerson Specification Compliance Manager	Up to 2023_q4
Emerson Static Test Software Suite	Up to 1.2
Emerson Sts Software Bundle	Up to 21.0
Emerson Systemlink Server	Before 2024_q1

Related CWEs

CWE-276

Incorrect Default Permissions

During installation, installed file permissions are set to allow anyone to modify those files.

CWE-863

Incorrect Authorization

The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.

References (2)

https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/incorrect-permissions-for-shared-systemlink-elixir-based-service.html

Source: security@ni.com

ExploitVendor Advisory

https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/incorrect-permissions-for-shared-systemlink-elixir-based-service.html

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitVendor Advisory

Timeline

No history available yet.