CVE-2024-6121

2024-07-2220:15:04

CWE-1395

web.nvd.nist.gov

redis

vulnerabilities

ni systemlink server

ni flexlogger

shared service

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

7.6

Confidence

High

EPSS

0.003

Percentile

66.7%

JSON

An out-of-date version of Redis shipped with NI SystemLink Server is susceptible to multiple vulnerabilities, including CVE-2022-24834. This affects NI SystemLink Server 2024 Q1 and prior versions. It also affects NI FlexLogger 2023 Q2 and prior versions which installed this shared service.

Affected configurations

Nvd

Node

niflexloggerRange≤2023

niflexloggerMatch2023q2

Node

nisystemlinkRange≤2024

nisystemlinkMatch2024q1

VendorProductVersionCPE
niflexlogger*cpe:2.3:a:ni:flexlogger:*:*:*:*:*:*:*:*
niflexlogger2023cpe:2.3:a:ni:flexlogger:2023:q2:*:*:*:*:*:*
nisystemlink*cpe:2.3:a:ni:systemlink:*:*:*:*:*:*:*:*
nisystemlink2024cpe:2.3:a:ni:systemlink:2024:q1:*:*:*:*:*:*

Vendor	Product	Version	CPE
ni	flexlogger	*	cpe:2.3:a:ni:flexlogger::::::::
ni	flexlogger	2023	cpe:2.3:a:ni:flexlogger:2023:q2::::::
ni	systemlink	*	cpe:2.3:a:ni:systemlink::::::::
ni	systemlink	2024	cpe:2.3:a:ni:systemlink:2024:q1::::::

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "platforms": [
      "Windows"
    ],
    "product": "SystemLink Server",
    "vendor": "NI",
    "versions": [
      {
        "lessThanOrEqual": "24.1",
        "status": "affected",
        "version": "0",
        "versionType": "semver"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "platforms": [
      "Windows"
    ],
    "product": "FlexLogger",
    "vendor": "NI",
    "versions": [
      {
        "lessThanOrEqual": "23.2",
        "status": "affected",
        "version": "0",
        "versionType": "semver"
      }
    ]
  }
]