CVE-2024-6791
Directory Path Traversal Vulnerability in NI VeriStand with vsmodel Files
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
A directory path traversal vulnerability exists when loading a vsmodel file in NI VeriStand that may result in remote code execution. Successful exploitation requires an attacker to get a user to open a specially crafted .vsmodel file. This vulnerability affects VeriStand 2024 Q2 and prior versions.
Existe una vulnerabilidad de path traversal de directorio al cargar un archivo vsmodel en NI VeriStand que puede resultar en la ejecución remota de código. La explotación exitosa requiere que un atacante consiga que un usuario abra un archivo .vsmodel especialmente manipulado. Esta vulnerabilidad afecta a VeriStand 2024 Q2 y versiones anteriores.
This vulnerability allows remote attackers to execute arbitrary code on affected installations of NI VeriStand. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.
The specific flaw exists within the parsing of VSMODEL files. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of the current user.
CVSS Scores
SSVC
- Decision:Track*
Timeline
- 2024-07-16 CVE Reserved
- 2024-07-22 CVE Published
- 2024-08-01 CVE Updated
- 2024-09-18 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CAPEC
- CAPEC-126: Path Traversal
References (1)
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|