82
CVEs
11
Critical
59
High
0
KEV
2
PoC
51
Unpatched C/H
28.0%
Patch Rate
0.3%
Avg EPSS
Severity Breakdown
CRITICAL
11
HIGH
59
MEDIUM
12
LOW
0
Monthly CVE Trend
Affected Products (29)
Labview
35
Dasylab
7
Grpc Device
7
Instrumentstudio
7
Circuit Design Suite
7
Veristand
6
Flexlogger
5
Systemlink
5
Ni Pal
4
Measurementstudio
4
Labwindows
4
Teststand
3
Systemlink Server
2
Diadem
2
Ni Service Locator
1
Vision Builder Ai
1
System Configuration
1
Redis
1
Python
1
G Web Development Software
1
Measurementlink
1
Datamanager
1
Compactrio Firmware
1
Labview Command Line Interface
1
Systemlink Enterprise
1
Lookout
1
Static Test Software Suite
1
Configuration Manager
1
Topografix Data Plugin
1
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2017-2775 | An exploitable memory corruption vulnerability exists in the LvVariantUnflatten functionality in 64-bit versions of LabVIEW before 2015 SP1 f7 Patch and 2016 before f2 Patch. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required. Public exploit code available and no vendor patch available. | HIGH | 7.5 | 0.6% | 58 |
PoC
No patch
|
| CVE-2017-2779 | An exploitable memory corruption vulnerability exists in the RSRC segment parsing functionality of LabVIEW 2017, LabVIEW 2016, LabVIEW 2015, and LabVIEW 2014. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required. Public exploit code available and no vendor patch available. | HIGH | 7.5 | 0.5% | 58 |
PoC
No patch
|
| CVE-2013-5022 | Absolute path traversal vulnerability in the 3D Graph ActiveX control in cw3dgrph.ocx in National Instruments LabWindows/CVI 2012 SP1 and earlier, LabVIEW 2012 SP1 and earlier, and other products. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, low attack complexity. | CRITICAL | 10.0 | 1.4% | 51 |
|
| CVE-2013-5026 | An ActiveX control in lookout650.ocx, lookout660.ocx, and lookout670.ocx in National Instruments Lookout 6.5 through 6.7 allows remote attackers to execute arbitrary code by triggering the download. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable. | CRITICAL | 9.3 | 4.4% | 51 |
|
| CVE-2023-4601 | A stack-based buffer overflow vulnerability exists in NI System Configuration that could result in information disclosure and/or arbitrary code execution. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available. | CRITICAL | 9.8 | 0.6% | 49 |
No patch
|
| CVE-2024-6793 | A deserialization of untrusted data vulnerability exists in NI VeriStand DataLogging Server that may result in remote code execution. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available. | CRITICAL | 9.8 | 1.2% | 49 |
No patch
|
| CVE-2024-6794 | A deserialization of untrusted data vulnerability exists in NI VeriStand Waveform Streaming Server that may result in remote code execution. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available. | CRITICAL | 9.8 | 1.2% | 49 |
No patch
|
| CVE-2024-6805 | The NI VeriStand Gateway is missing authorization checks when an actor attempts to access File Transfer resources. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available. | CRITICAL | 9.8 | 1.0% | 49 |
No patch
|
| CVE-2024-6806 | The NI VeriStand Gateway is missing authorization checks when an actor attempts to access Project resources. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available. | CRITICAL | 9.8 | 1.0% | 49 |
No patch
|
| CVE-2013-5021 | Multiple absolute path traversal vulnerabilities in National Instruments cwui.ocx, as used in National Instruments LabWindows/CVI 2012 SP1 and earlier, National Instruments LabVIEW 2012 SP1 and. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable. No vendor patch available. | CRITICAL | 9.3 | 0.7% | 47 |
No patch
|
| CVE-2026-48137 | Remote code execution in NI grpc-device 2.17.0 and earlier is possible when an attacker sends a specially crafted Moniker protobuf message to the sideband streaming API, triggering an untrusted pointer dereference (CWE-822). The flaw is reachable without authentication or user interaction over the network, yielding a CVSS 4.0 base score of 9.3. No public exploit identified at time of analysis, but vendor advisories from NI and the upstream GitHub Security Advisory GHSA-ww59-ghm9-mm63 are published. | CRITICAL | 9.3 | 0.5% | 47 |
No patch
|
| CVE-2026-9142 | Unauthenticated network access to NI grpc-device 2.17.0 and earlier is possible when the server is deployed without TLS configuration and bound to a non-loopback interface, exposing instrument control services to anyone on the local network. The flaw stems from insecure default credentials behavior and aligns with CWE-306 (missing authentication for a critical function). No public exploit identified at time of analysis, though the CVSS 4.0 base score of 9.3 reflects high confidentiality and integrity impact under default-prone deployments. | CRITICAL | 9.3 | 0.3% | 47 |
No patch
|
| CVE-2026-9051 | Authentication bypass in NI SystemLink Enterprise Dashboard (versions 2026-04 and prior) allows a remote, unauthenticated attacker to send a crafted HTTP request that circumvents authentication controls, leading to privilege escalation or disclosure of sensitive information. The flaw carries a CVSS 4.0 base score of 9.3 and is network-reachable with low attack complexity and no user interaction. No public exploit identified at time of analysis, and it is not currently listed in CISA KEV. | CRITICAL | 9.3 | 0.0% | 47 |
No patch
|
| CVE-2025-2449 | NI FlexLogger usiReg URI File Parsing Directory Traversal Remote Code Execution Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available. | HIGH | 8.8 | 0.8% | 45 |
No patch
|
| CVE-2025-2450 | NI Vision Builder AI VBAI File Processing Missing Warning Remote Code Execution Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available. | HIGH | 8.8 | 0.2% | 44 |
No patch
|