CVE-2024-12741CWE-502

Deserialization Of Untrusted Data Vulnerability In NI DAQExpress Project File

High · published December 18, 2024

CVSS v4.0
8.4
EPSS
4%
Percentile
90.9
In the wild
Unconfirmed
What it is

A deserialization of untrusted data vulnerability exists in NI DAQExpress that may result in remote code execution. Successful exploitation requires an attacker to get a user to open a specially crafted project file. This vulnerability affects DAQExpress 5.1 and prior versions.  Please note that DAQExpress is an EOL product and will not receive any updates.

The record
Technical detail
CVSS v4.0
8.4 · HIGH
Vector
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.04211 · 90.9th percentile
Weakness
CWE-502 · Deserialization of Untrusted Data
Published
2024-12-18T19:20Z
EPSS history
Timeline
  • 18 DEC 19:20Z
    Deserialization Of Untrusted Data Vulnerability In NI DAQExpress Project File
    cvelistv5