EUVD-2026-38027Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach grpc-device gRPC port
-
DeliveryOpen data moniker request
-
ExploitSupply unknown moniker value
-
ExecutionServer dereferences NULL pointer
-
Persistgrpc-device process crashes
-
ImpactInstrument control sessions denied
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A10:2025 - Mishandling of Exceptional Conditions
ASVS 5.0
V16 - Security Logging and Error Handling Null pointer safety, defensive checks
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The attacker must have network reachability to the NI grpc-device server's gRPC listener and must send a request to the data moniker service containing a moniker value that is not registered on the target server; no authentication, user interaction, or non-default configuration is required, because grpc-device exposes the moniker service as part of its normal data-streaming API. Limiting factors are deployment-driven rather than code-driven: grpc-device is typically run on engineering or lab hosts and is not exposed to the public internet by default, so realistic exploitation requires the attacker to already be on the same lab/OT network segment as the server, and impact is confined to availability of that single server instance (VC:N/VI:N/SC:N/SI:N/SA:N). |
| Impact | Signals are largely consistent and point to a real but bounded availability risk. The CVSS 4.0 vector AV:N/AC:L/AT:N/PR:N/UI:N with VA:H and VC:N/VI:N confirms a network-reachable, unauthenticated, low-complexity DoS with no confidentiality or integrity impact, which is exactly what CWE-476 in a service entry point would yield. EPSS and CISA KEV status are not provided in the input, and no public PoC is referenced, so likelihood of opportunistic mass exploitation is presently unquantified; however, the trigger ('provide an unknown value to the data moniker service') is trivial to reproduce by anyone with network reach to the gRPC endpoint. The priority should therefore be driven by exposure rather than score: lab/production deployments where the grpc-device port is reachable by untrusted networks warrant urgent patching, while air-gapped or tightly segmented test benches face materially lower real-world risk. |
| Exploit ScenarioDerived | An attacker with network access to the grpc-device gRPC port opens a connection to the data moniker service and issues a request referencing an arbitrary moniker name that has not been registered. The server dereferences a NULL lookup result and the process crashes, taking down all instrument control sessions multiplexed through that server; the attacker can repeat the request after each restart to sustain the outage. No public exploit is identified at time of analysis, but the trigger is described concretely enough that a working PoC is straightforward to write against the open-source gRPC schema. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv3 – Jun 19, 2026
Denial of service in NI grpc-device 2.17.0 and prior allows remote unauthenticated attackers to crash the data moniker service by submitting an unknown value that triggers a NULL pointer dereference. The flaw also impacts deployments embedding the server via NI InstrumentStudio. No public exploit is identified at time of analysis, though the CVSS 4.0 base score of 8.7 reflects high availability impact reachable over the network without privileges.
Earlier versions of this analysis (2)
Denial of service in NI grpc-device 2.17.0 and prior allows remote unauthenticated attackers to crash the data moniker service by submitting an unknown value, triggering a NULL pointer dereference (CWE-476). The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) reflects network-reachable, no-auth exploitation with high availability impact and no confidentiality or integrity loss. No public exploit identified at time of analysis; NI has published a vendor advisory and a GitHub Security Advisory addressing the issue.
Remote denial of service in NI grpc-device 2.17.0 and earlier allows unauthenticated attackers to crash the data moniker service by submitting an unknown value, triggering a NULL pointer dereference. The flaw also affects NI InstrumentStudio deployments that rely on grpc-device, and while no public exploit identified at time of analysis, the network-reachable, no-auth attack surface and high availability impact make it a meaningful risk for instrumentation environments. EPSS data was not provided in the input, so likelihood of exploitation cannot be quantitatively ranked.
RemediationAI
Patch available per vendor advisory: upgrade NI grpc-device to the fixed release published in GHSA-7vg9-5c74-289x (https://github.com/ni/grpc-device/security/advisories/GHSA-7vg9-5c74-289x) and apply the corresponding NI InstrumentStudio update referenced in the NI security bulletin (https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/2026/multiple-vulnerabilities-in-ni-grpc-device-server.html); the specific patched version string is not enumerated in the provided data, so confirm the exact build from those advisories before deployment. Until patched, restrict network reachability of the grpc-device listener to trusted hosts via host firewall or network ACLs and place the service behind a VPN or jumphost (trade-off: legitimate remote test stations must be reconfigured to the new access path), and avoid exposing the data moniker endpoint to shared lab networks. Monitor the grpc-device process for unexpected restarts as a detection signal and configure a process supervisor to auto-restart the service so a single crash does not produce extended outage, accepting that auto-restart masks repeated abuse and should be paired with logging.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
NI grpc-device is National Instruments' open-source gRPC server that exposes test, measurement, and instrument-control driver APIs (NI-DAQmx, NI-DCPower, NI-VISA, etc.) to remote clients, and it is bundled with NI InstrumentStudio for remote instrument access. The data moniker service is the streaming/data-routing component used to publish and consume measurement data via named monikers. The root cause is CWE-476 (NULL Pointer Dereference): the service dereferences a pointer derived from a client-supplied moniker value without validating that the lookup succeeded, so an unknown/unregistered value yields a NULL handle that is then used, terminating the server process.
Know when Grpc Device gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Network-reachable gRPC service, low-complexity unknown-value trigger, no auth or user interaction, scope unchanged, impact limited to availability (process crash) with no confidentiality or integrity loss.
Primary rating from Vendor (NI).
CVSS VectorVendor: NI
Lifecycle Timeline
1DescriptionCVE.org
There is a NULL pointer dereference vulnerability in NI grpc-device in the data moniker service that may allow an attacker to cause a denial of service by triggering a crash. Successful exploitation requires an attacker to provide an unknown value to the data moniker service. This affects NI grpc-device 2.17.0 and prior versions.
Executive ViewAI
Organizations running NI grpc-device 2.17.0 and earlier face a denial-of-service vulnerability that allows remote unauthenticated attackers to crash critical instrumentation services, disrupting operations and testing capabilities. The flaw also impacts systems deployed through NI InstrumentStudio. No public exploit identified at time of analysis, though CVSS 8.7 indicates significant availability risk.
No vendor-released patch identified at time of analysis. Interim mitigations: Implement network segmentation restricting grpc-device service access to trusted internal networks; deploy network-level rate limiting to mitigate DoS attempts; strengthen monitoring and alerting for service availability and crash events; establish runbooks and test procedures for rapid service restoration.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A null pointer dereference occurs when a program attempts to access memory through a pointer that has been set to NULL (address 0x0).
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
More in Grpc Device
View allRemote code execution in NI grpc-device 2.17.0 and earlier is possible when an attacker sends a specially crafted Monike
Unauthenticated network access to NI grpc-device 2.17.0 and earlier is possible when the server is deployed without TLS
Remote denial of service in NI grpc-device 2.17.0 and earlier allows unauthenticated network attackers to crash the stre
Denial of service in NI grpc-device 2.17.0 and earlier allows an authenticated remote attacker to crash or destabilize t
Silent integer truncation in NI grpc-device 2.17.0 and earlier allows unauthenticated network-accessible attackers to co
Memory exhaustion denial of service in NI grpc-device's BeginSidebandStream RPC endpoint allows authenticated network at
Exploit-DB