CVE-2026-9142

There is an insecure default credentials vulnerability in NI grpc-device when TLS configuration is not present and the server is bound beyond loopback. This may allow an unauthenticated user access to the server on the local network. This affects NI grpc-device 2.17.0 and prior versions.

CVSS v3 9.1 CRITICAL

9.1^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/ni/grpc-device/security/advisories/GHSA-fhhw-37q8-6562	Vendor Advisory
https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/2026/multiple-vulnerabilities-in-ni-grpc-device-server.html	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:ni:instrumentstudio::::::::
	cpe:2.3:a:ni:instrumentstudio:2026:q1::::::
	cpe:2.3:a:ni:instrumentstudio:2026:q2::::::

Configuration 2 (hide)

cpe:2.3:a:ni:ni_grpc_device_server:*:*:*:*:*:*:*:*

History

25 Jun 2026, 14:40

Type	Values Removed	Values Added
References	~~() https://github.com/ni/grpc-device/security/advisories/GHSA-fhhw-37q8-6562 -~~	() https://github.com/ni/grpc-device/security/advisories/GHSA-fhhw-37q8-6562 - Vendor Advisory
References	~~() https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/2026/multiple-vulnerabilities-in-ni-grpc-device-server.html -~~	() https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/2026/multiple-vulnerabilities-in-ni-grpc-device-server.html - Vendor Advisory
CPE		cpe:2.3:a:ni:ni_grpc_device_server:::::::: cpe:2.3:a:ni:instrumentstudio:::::::: cpe:2.3:a:ni:instrumentstudio:2026:q2:::::: cpe:2.3:a:ni:instrumentstudio:2026:q1::::::
First Time		Ni Ni instrumentstudio Ni ni Grpc Device Server

19 Jun 2026, 14:16

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-06-19 14:16

Updated : 2026-06-25 14:40

NVD link : CVE-2026-9142

Mitre link : CVE-2026-9142

CVE.ORG link : CVE-2026-9142

JSON object : View

Products Affected

ni

instrumentstudio
ni_grpc_device_server

CWE

CWE-306

Missing Authentication for Critical Function

{"id": "CVE-2026-9142", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-9142", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-06-22T19:29:24.594424Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security@ni.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 3.9}], "cvssMetricV40": [{"type": "Secondary", "source": "security@ni.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 9.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security@ni.com", "affectedData": [{"vendor": "NI", "product": "grpc-device", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "2.17.0"}], "defaultStatus": "unaffected"}, {"vendor": "NI", "product": "InstrumentStudio", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "26.3.0"}], "defaultStatus": "unaffected"}]}], "published": "2026-06-19T14:16:24.423", "references": [{"url": "https://github.com/ni/grpc-device/security/advisories/GHSA-fhhw-37q8-6562", "tags": ["Vendor Advisory"], "source": "security@ni.com"}, {"url": "https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/2026/multiple-vulnerabilities-in-ni-grpc-device-server.html", "tags": ["Vendor Advisory"], "source": "security@ni.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security@ni.com", "description": [{"lang": "en", "value": "CWE-306"}]}], "descriptions": [{"lang": "en", "value": "There is an insecure default credentials vulnerability in NI grpc-device when TLS configuration is not present and the server is bound beyond loopback.\u00a0 This may allow an unauthenticated user access to the server on the local network.\u00a0 This affects NI grpc-device 2.17.0 and prior versions."}], "lastModified": "2026-06-25T14:40:14.680", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:ni:instrumentstudio:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "87FF2C16-85F8-4F69-BF2D-0FB5D7049C6C", "versionEndIncluding": "2025"}, {"criteria": "cpe:2.3:a:ni:instrumentstudio:2026:q1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E403ACA4-50C9-49CC-9E8A-108929808AB3"}, {"criteria": "cpe:2.3:a:ni:instrumentstudio:2026:q2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FE21F1C5-405D-4980-9248-50C2D71A91D2"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:ni:ni_grpc_device_server:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D293F76D-29A0-49D7-A538-456A7B209E0A", "versionEndExcluding": "2.18.0"}], "operator": "OR"}]}], "sourceIdentifier": "security@ni.com"}