Skip to main content

Flexlogger CVE-2024-6122

MEDIUM
Incorrect Default Permissions (CWE-276)
2024-07-22 security@ni.com
Privilege Escalation Information Disclosure Flexlogger Systemlink Ni
5.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None

Lifecycle Timeline

1
CVE Published
Jul 22, 2024 - 20:15 nvd
MEDIUM 5.5

DescriptionNVD

An incorrect permission in the installation directory for the shared NI SystemLink Server KeyValueDatabase service may result in information disclosure via local access. This affects NI SystemLink Server 2024 Q1 and prior versions. It also affects NI FlexLogger 2023 Q2 and prior versions which installed this shared service.

AnalysisAI

An incorrect permission in the installation directory for the shared NI SystemLink Server KeyValueDatabase service may result in information disclosure via local access. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified as Incorrect Default Permissions (CWE-276), which allows attackers to access resources due to overly permissive default settings. An incorrect permission in the installation directory for the shared NI SystemLink Server KeyValueDatabase service may result in information disclosure via local access. This affects NI SystemLink Server 2024 Q1 and prior versions. It also affects NI FlexLogger 2023 Q2 and prior versions which installed this shared service. Affected products include: Ni Systemlink, Ni Flexlogger.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Set restrictive default permissions, follow principle of least privilege, review defaults during deployment.

More in Flexlogger

View all
CVE-2024-1156 HIGH POC
7.8 Feb 20

Incorrect directory permissions for the shared NI RabbitMQ service may allow a local authenticated user to read RabbitMQ
CVE-2024-1155 HIGH POC
7.8 Feb 20

Incorrect permissions in the installation directories for shared SystemLink Elixir based services may allow an authentic
CVE-2025-2449 HIGH
8.8 Mar 18

NI FlexLogger usiReg URI File Parsing Directory Traversal Remote Code Execution Vulnerability. Rated high severity (CVSS
CVE-2024-6121 HIGH
7.8 Jul 22

An out-of-date version of Redis shipped with NI SystemLink Server is susceptible to multiple vulnerabilities, including

CVE-2022-27237 MEDIUM
6.1 Apr 21

There is a cross-site scripting (XSS) vulnerability in an NI Web Server component installed with several NI products. Ra
CVE-2023-5136 MEDIUM
5.5 Nov 08

An incorrect permission assignment in the TopoGrafix DataPlugin for GPX could result in information disclosure. Rated me

Same weakness CWE-276 – Incorrect Default Permissions

View all
CVE-2013-0632 CRITICAL POC
9.8
CVE-2017-11610 HIGH POC
8.8
CVE-2022-22948 MEDIUM POC
6.5
CVE-2017-8625 HIGH POC
8.8
CVE-2016-5425 HIGH POC
7.8
CVE-2024-55215 CRITICAL POC
9.8
CVE-2024-57604 CRITICAL POC
9.8
CVE-2024-28056 CRITICAL POC
9.8

Same technique Privilege Escalation

View all
CVE-2024-0012 CRITICAL POC
9.3
CVE-2025-47812 CRITICAL POC
10.0
CVE-2013-0422 CRITICAL POC
9.8
CVE-2013-0632 CRITICAL POC
9.8
CVE-2024-9474 MEDIUM POC
6.9
CVE-2017-5689 CRITICAL POC
9.8
CVE-2021-20021 CRITICAL POC
9.8
CVE-2017-12635 CRITICAL POC
9.8

Share

CVE-2024-6122 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy