Skip to main content

NI grpc-device CVE-2026-9143

| EUVDEUVD-2026-38032 MEDIUM
Incorrect Conversion between Numeric Types (CWE-681)
2026-06-19 NI
Information Disclosure Grpc Device Instrumentstudio
6.3
CVSS 4.0 · Vendor: NI
Share

Severity by source

Vendor (NI) PRIMARY
6.3 LOW
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
3.7 LOW

Network-reachable gRPC server, no auth required per PR:N, but precise boundary-value crafting needed (AC:H); impact is integrity-only data truncation with no confidentiality or availability consequence.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (NI).

CVSS VectorVendor: NI

CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

3
Analysis Generated
Jun 19, 2026 - 14:29 vuln.today
Severity Changed
Jun 19, 2026 - 14:22 NVD
LOW MEDIUM
CVSS changed
Jun 19, 2026 - 14:22 NVD
3.7 (LOW) 6.3 (MEDIUM)

DescriptionCVE.org

There is an incorrect conversion between numeric types vulnerability in NI grpc-device due to missing range checks in CodeGen.  This may silently discard high bits if a size value exceeded the target type's range. This affects NI grpc-device 2.17.0 and prior versions.

AnalysisAI

Silent integer truncation in NI grpc-device 2.17.0 and earlier allows unauthenticated network-accessible attackers to corrupt size values processed by the CodeGen component, potentially causing integrity violations in instrument control operations. The root cause is CWE-681 - missing range checks during numeric type conversion in CodeGen - meaning oversized size fields silently lose their high-order bits rather than being rejected or flagged. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Recon
Identify exposed gRPC-device server port
Delivery
Craft gRPC request with boundary-crossing size field
Exploit
Submit request without authentication
Install
CodeGen converts value without range check
C2
High-order bits silently truncated
Execute
Server processes corrupted size value
Impact
Instrument operation executes with incorrect parameters
Sign in to reveal

Vulnerability AssessmentAI

Exploitation The NI grpc-device server must be network-reachable from the attacker's position, consistent with AV:N in the CVSS 4.0 vector. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 4.0 score of 6.3 with vector AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N reflects a moderate-risk, remotely exploitable flaw constrained by high attack complexity. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker with network access to an exposed gRPC-device server constructs a gRPC message containing a size or length field set to a value exceeding the maximum of the target integer type used internally by CodeGen (for example, a value above 2^31-1 when the target is a signed 32-bit integer). The CodeGen layer converts this value without a bounds check, silently discards the high-order bits, and produces an incorrect, smaller size value that the server uses to process subsequent instrument commands or data frames. …
Remediation The primary remediation is to update NI grpc-device beyond version 2.17.0 per the NI security advisory at https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/2026/multiple-vulnerabilities-in-ni-grpc-device-server.html. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Grpc Device

View all
CVE-2026-48137 CRITICAL
9.3 Jun 19

Remote code execution in NI grpc-device 2.17.0 and earlier is possible when an attacker sends a specially crafted Monike
CVE-2026-9142 CRITICAL
9.3 Jun 19

Unauthenticated network access to NI grpc-device 2.17.0 and earlier is possible when the server is deployed without TLS

CVE-2026-48139 HIGH
8.7 Jun 19

Denial of service in NI grpc-device 2.17.0 and prior allows remote unauthenticated attackers to crash the data moniker s
CVE-2026-48138 HIGH
8.7 Jun 19

Remote denial of service in NI grpc-device 2.17.0 and earlier allows unauthenticated network attackers to crash the stre
CVE-2026-48140 HIGH
7.1 Jun 19

Denial of service in NI grpc-device 2.17.0 and earlier allows an authenticated remote attacker to crash or destabilize t
CVE-2026-48141 MEDIUM
6.0 Jun 19

Memory exhaustion denial of service in NI grpc-device's BeginSidebandStream RPC endpoint allows authenticated network at

Same weakness CWE-681 – Incorrect Conversion between Numeric Types

View all
CVE-2026-26178 HIGH
8.8
CVE-2026-24192 HIGH
7.8
CVE-2026-4602 HIGH
7.7
CVE-2026-24174 HIGH
7.5
CVE-2026-4931 MEDIUM
6.8
CVE-2026-34550 MEDIUM
6.2
CVE-2026-34548 MEDIUM
6.2
CVE-2026-34610 MEDIUM
5.9

Same technique Information Disclosure

View all
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2014-6324 HIGH POC
8.8
CVE-2017-0213 HIGH POC
7.3
CVE-2016-7255 HIGH POC
7.8
CVE-2010-0232 HIGH POC
7.8
CVE-2025-30066 HIGH POC
8.6
CVE-2025-54236 CRITICAL POC
9.1

Share

CVE-2026-9143 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy