{"id":"CVE-2026-4130","state":"PUBLISHED","title":"Storage of Sensitive Information in Cleartext in NI SystemLink","description":"There is a storage of sensitive information in cleartext vulnerability in NI SystemLink. This vulnerability may allow an attacker with local access to obtain sensitive information stored by the system in the clear.  This vulnerability affects NI SystemLink and NI SystemLink Server versions prior to 2026 Q3.","publishedAt":"2026-09-10T15:38:34.057Z","updatedAt":"2026-09-16T16:24:48.195Z","severity":{"score":8.4,"label":"High","version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","source":"NI"},"assigner":"NI","products":["NI SystemLink","NI SystemLink Server"],"affected":[{"vendor":"NI","product":"SystemLink","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"26.5.0","versionType":"semver"}]},{"vendor":"NI","product":"SystemLink Server","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"26.5.0","versionType":"semver"}]}],"references":["https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/2026/storage-of-sensitive-information-in-cleartext-in-ni-systemlink.html"],"weaknesses":["CWE-312"],"ingestedAt":"2026-10-29T20:12:16.098Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/4xxx/CVE-2026-4130.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-4130","state":"PUBLISHED","datePublished":"2026-09-10T15:38:34.057Z","dateUpdated":"2026-09-16T16:24:48.195Z","assignerShortName":"NI","assignerOrgId":"bca5b2e8-03a4-4781-b4ca-c6a078c0bfd4","dateReserved":"2026-03-13T14:11:51.198Z"},"containers":{"cna":{"title":"Storage of Sensitive Information in Cleartext in NI SystemLink","descriptions":[{"lang":"en","value":"There is a storage of sensitive information in cleartext vulnerability in NI SystemLink. This vulnerability may allow an attacker with local access to obtain sensitive information stored by the system in the clear.  This vulnerability affects NI SystemLink and NI SystemLink Server versions prior to 2026 Q3."}],"affected":[{"vendor":"NI","product":"SystemLink","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"26.5.0","versionType":"semver"}]},{"vendor":"NI","product":"SystemLink Server","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"26.5.0","versionType":"semver"}]}],"references":[{"url":"https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/2026/storage-of-sensitive-information-in-cleartext-in-ni-systemlink.html"}],"metrics":[{"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}],"cvssV3_1":{"version":"3.1","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE","baseSeverity":"HIGH","baseScore":7.1,"vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N"}},{"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}],"cvssV4_0":{"attackVector":"LOCAL","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","subIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","version":"4.0","baseSeverity":"HIGH","baseScore":8.4,"vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-312","lang":"en","description":"CWE-312 Cleartext storage of sensitive information","type":"CWE"}]}],"providerMetadata":{"shortName":"NI","orgId":"bca5b2e8-03a4-4781-b4ca-c6a078c0bfd4","dateUpdated":"2026-09-16T16:24:48.195Z"},"impacts":[{"capecId":"CAPEC-37","descriptions":[{"lang":"en","value":"CAPEC-37 Retrieve Embedded Sensitive Data"}]}],"cpeApplicability":[{"operator":"OR","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:ni:systemlink:*:*:*:*:*:*:*:*","versionStartIncluding":"0","versionEndExcluding":"26.5.0"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:ni:systemlink_server:*:*:*:*:*:*:*:*","versionStartIncluding":"0","versionEndExcluding":"26.5.0"}]}]}],"source":{"discovery":"UNKNOWN"},"x_generator":{"engine":"Vulnogram 1.0.5"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-09-11T00:00:00+00:00","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3","id":"CVE-2026-4130"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-09-12T03:55:27.181Z"}}]}}}