NI grpc-device CVE-2026-48140

Exploitation requires network reachability to the NI grpc-device server's gRPC listener and low-privileged authentication to invoke the BeginSidebandStream RPC (CVSS PR:L), plus the ability to craft a protobuf message with an integer value outside the declared enum range for the sideband-stream parameter. Limiting factors are the PR:L authentication requirement (an entirely anonymous Internet attacker cannot exploit it without first obtaining gRPC service credentials), the requirement that the target be running grpc-device 2.17.0 or earlier, and that grpc-device deployments are typically constrained to lab or test-bench networks rather than exposed to the open Internet, which reduces realistic attack surface. No user interaction is required (UI:N) and attack complexity is low (AC:L), so once a credentialed attacker can reach the endpoint, exploitation is trivial.

The CVSS 4.0 vector AV:N/AC:L/AT:N/PR:L/UI:N with VA:H and VC:N/VI:N indicates a low-complexity network-reachable denial of service requiring some level of authentication (PR:L), scoring 7.1. No EPSS, KEV, or POC data was supplied - no public exploit identified at time of analysis and not on CISA KEV - so the realistic risk is limited to environments where grpc-device is exposed to semi-trusted clients on a lab or shared test network. The impact is bounded: integrity and confidentiality are explicitly not affected, only availability of the instrumentation service, which is nonetheless meaningful in production test rigs where an unavailable instrument server stalls hardware-in-the-loop pipelines. Authentication requirements per CVSS PR:L indicate a low-privileged credentialed attacker, which is consistent with grpc-device's typical deployment where clients possess service credentials.

An attacker who has obtained low-privileged gRPC credentials - for example a shared lab service account or a compromised engineering workstation on the test network - connects to the grpc-device server and issues a BeginSidebandStream call with a protobuf field set to an integer outside the defined enum range. The unchecked cast yields undefined behavior in the server's dispatch logic, crashing the grpc-device process and taking down all instrument control sessions for connected clients. No public exploit identified at time of analysis, but a one-line protobuf modification using grpcurl or a custom client is sufficient given knowledge of the message schema, which is open source.