{"id":"CVE-2024-6122","state":"PUBLISHED","title":"Incorrect Default Directory Permissions for NI SystemLink Redis Service","description":"An incorrect permission in the installation directory for the shared NI SystemLink Server KeyValueDatabase service may result in information disclosure via local access.  This affects NI SystemLink Server 2024 Q1 and prior versions.  It also affects NI FlexLogger 2023 Q2 and prior versions which installed this shared service.","publishedAt":"2024-07-22T19:27:10.034Z","updatedAt":"2024-08-01T21:33:04.403Z","severity":{"score":5.5,"label":"Medium","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","source":"NI"},"assigner":"NI","products":["NI SystemLink Server","NI FlexLogger"],"affected":[{"vendor":"NI","product":"SystemLink Server","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"24.1","versionType":"semver"}],"platforms":["Windows"]},{"vendor":"NI","product":"FlexLogger","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"23.2","versionType":"semver"}],"platforms":["Windows"]}],"references":["https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/incorrect-default-directory-permissions-for-ni-systemlink-redis-service.html"],"weaknesses":["CWE-276"],"ingestedAt":"2026-10-29T20:08:12.933Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2024/6xxx/CVE-2024-6122.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2024-6122","state":"PUBLISHED","datePublished":"2024-07-22T19:27:10.034Z","dateUpdated":"2024-08-01T21:33:04.403Z","assignerShortName":"NI","assignerOrgId":"bca5b2e8-03a4-4781-b4ca-c6a078c0bfd4","dateReserved":"2024-06-18T11:42:00.421Z"},"containers":{"cna":{"title":"Incorrect Default Directory Permissions for NI SystemLink Redis Service","descriptions":[{"lang":"en","value":"An incorrect permission in the installation directory for the shared NI SystemLink Server KeyValueDatabase service may result in information disclosure via local access.  This affects NI SystemLink Server 2024 Q1 and prior versions.  It also affects NI FlexLogger 2023 Q2 and prior versions which installed this shared service."}],"affected":[{"vendor":"NI","product":"SystemLink Server","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"24.1","versionType":"semver"}],"platforms":["Windows"]},{"vendor":"NI","product":"FlexLogger","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"23.2","versionType":"semver"}],"platforms":["Windows"]}],"references":[{"url":"https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/incorrect-default-directory-permissions-for-ni-systemlink-redis-service.html"}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-276","description":"CWE-276 Incorrect Default Permissions","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"NI","orgId":"bca5b2e8-03a4-4781-b4ca-c6a078c0bfd4","dateUpdated":"2024-07-22T19:27:10.034Z"},"credits":[{"lang":"en","type":"finder","value":"06fe5fd2bc53027c4a3b7e395af0b850e7b8a044 working with Trend Micro Zero Day Initiative"}],"impacts":[{"capecId":"CAPEC-1","descriptions":[{"lang":"en","value":"CAPEC-1 Accessing Functionality Not Properly Constrained by ACLs"}]}],"source":{"discovery":"UNKNOWN"},"x_generator":{"engine":"Vulnogram 0.2.0"}},"adp":[{"title":"CISA ADP Vulnrichment","affected":[{"vendor":"ni","product":"systemlink","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"2024q1","versionType":"semver"}],"cpes":["cpe:2.3:a:ni:systemlink:*:*:*:*:*:*:*:*"]},{"vendor":"ni","product":"flexlogger","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"2023q2","versionType":"semver"}],"cpes":["cpe:2.3:a:ni:flexlogger:*:*:*:*:*:*:*:*"]}],"metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2024-07-23T14:14:23.092610Z","id":"CVE-2024-6122","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2024-07-23T14:37:33.238Z"}},{"title":"CVE Program Container","references":[{"url":"https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/incorrect-default-directory-permissions-for-ni-systemlink-redis-service.html","tags":["x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-01T21:33:04.403Z"}}]}}}