CVE-2026-9142CWE-306

Insecure Default Credentials vulnerability in NI grpc-device when TLS configuration is not present

Critical · published June 19, 2026

CVSS v4.0
9.3
EPSS
0%
Percentile
36.6
In the wild
Unconfirmed
What it is

There is an insecure default credentials vulnerability in NI grpc-device when TLS configuration is not present and the server is bound beyond loopback.  This may allow an unauthenticated user access to the server on the local network.  This affects NI grpc-device 2.17.0 and prior versions.

The record
Technical detail
CVSS v4.0
9.3 · CRITICAL
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
EPSS
0.00434 · 36.6th percentile
Weakness
CWE-306 · Missing Authentication for Critical Function
Published
2026-06-19T13:41Z
EPSS history
Timeline
  • 19 JUN 13:41Z
    Insecure Default Credentials vulnerability in NI grpc-device when TLS configuration is not present
    cvelistv5