Systemlink Server
Monthly
Cleartext storage of sensitive information in NI SystemLink and NI SystemLink Server (all versions through 2026 Q3, ≤26.5.0) allows a local low-privileged user to read credentials, API keys, or other secrets written to disk without encryption. The vulnerability is rooted in CWE-312 and carries a CVSS 4.0 score of 8.4, reflecting high confidentiality and integrity impact for local access. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Improper access control in NI SystemLink and NI SystemLink Server (all versions through 26.5.0, 2026 Q3) allows a network-authenticated user with limited privileges to access host operating system files and directories that should be restricted. The root cause is CWE-862 (Missing Authorization) - the application authenticates the user but fails to enforce authorization boundaries between SystemLink application scope and the underlying host OS file system. No active exploitation or public proof-of-concept has been identified at time of analysis; the vulnerability is confirmed by NI's own security advisory.
Incorrect directory permissions for the shared NI RabbitMQ service may allow a local authenticated user to read RabbitMQ configuration information and potentially enable escalation of privileges. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.
Incorrect permissions in the installation directories for shared SystemLink Elixir based services may allow an authenticated user to potentially enable escalation of privilege via local access. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.
Cleartext storage of sensitive information in NI SystemLink and NI SystemLink Server (all versions through 2026 Q3, ≤26.5.0) allows a local low-privileged user to read credentials, API keys, or other secrets written to disk without encryption. The vulnerability is rooted in CWE-312 and carries a CVSS 4.0 score of 8.4, reflecting high confidentiality and integrity impact for local access. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Improper access control in NI SystemLink and NI SystemLink Server (all versions through 26.5.0, 2026 Q3) allows a network-authenticated user with limited privileges to access host operating system files and directories that should be restricted. The root cause is CWE-862 (Missing Authorization) - the application authenticates the user but fails to enforce authorization boundaries between SystemLink application scope and the underlying host OS file system. No active exploitation or public proof-of-concept has been identified at time of analysis; the vulnerability is confirmed by NI's own security advisory.
Incorrect directory permissions for the shared NI RabbitMQ service may allow a local authenticated user to read RabbitMQ configuration information and potentially enable escalation of privileges. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.
Incorrect permissions in the installation directories for shared SystemLink Elixir based services may allow an authenticated user to potentially enable escalation of privilege via local access. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.