CVE-2026-9142

Published: Jun 19, 2026Modified: Jun 25, 2026

9.3

Vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Show more

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XShow less

Source: security@ni.com (Secondary)

Description

There is an insecure default credentials vulnerability in NI grpc-device when TLS configuration is not present and the server is bound beyond loopback. This may allow an unauthenticated user access to the server on the local network. This affects NI grpc-device 2.17.0 and prior versions.

Affected (4)

Products: Ni: Instrumentstudio, Ni Grpc Device Server

2 products

Instrumentstudio

Ni Grpc Device Server

Configuration A

3 vulnerable

Vulnerable Software	Affected Versions
Ni Instrumentstudio	Up to 2025
Ni Instrumentstudio	Version 2026 q1
Ni Instrumentstudio	Version 2026 q2

Configuration B

1 vulnerable

Vulnerable Software	Affected Versions
Ni Ni Grpc Device Server	Before 2.18.0

Related CWEs

Missing Authentication for Critical Function

The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

References (2)

https://github.com/ni/grpc-device/security/advisories/GHSA-fhhw-37q8-6562

Source: security@ni.com

Vendor Advisory

https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/2026/multiple-vulnerabilities-in-ni-grpc-device-server.html

Source: security@ni.com

Vendor Advisory

Timeline

No history available yet.