NI SystemLink CVE-2026-4130

Exploitation requires an active local OS session on the NI SystemLink or SystemLink Server host with at minimum low-level user privileges (PR:L per CVSS 4.0 vector). No network-based or remote exploitation path is indicated - AV:L confines the attack to the local machine. No special product feature, protocol, or non-default configuration is required beyond having a local account; the vulnerability arises from how the platform persistently stores data. Limiting factors: remote unauthenticated exploitation is not possible; physical or RDP/SSH access to the host is a prerequisite; administrators who are the only local users on a locked-down server face near-zero realistic exposure.

The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H) confirms that exploitation is constrained to local access with low privilege, making remote unauthenticated exploitation impossible; this significantly reduces real-world risk compared to the raw score of 8.4 might suggest at first glance. EPSS data is not supplied, and the absence of a KEV listing or public PoC further reduces urgency for most defenders. That said, environments where SystemLink manages production test cells or acts as a secrets broker for distributed measurement nodes - and even a mid-sized industrial operation like those in kalisz running mixed OT/IT test infrastructure should treat this as a priority remediation - face meaningful credential-theft risk if any non-admin account is compromised or if an insider threat exists. The CVSS 4.0 VI:H metric is notable for a pure read primitive (CWE-312); it likely reflects the vendor's assessment that obtained credentials could subsequently enable integrity compromise through re-use, not a direct write impact from the vulnerability itself. No conflicting signals between sources; all data points align on a local, low-privilege, read-only exposure.

An attacker or malicious insider with a low-privileged local account on the SystemLink server host locates configuration or data files written by the platform, reads plaintext credentials or API tokens stored therein, and uses those secrets to authenticate to connected test nodes or upstream services - enabling lateral movement across the measurement infrastructure.