Ni Flexlogger vulnerabilities

CVE-2025-2449 [HIGH] CWE-22 CVE-2025-2449: NI FlexLogger usiReg URI File Parsing Directory Traversal Remote Code Execution Vulnerability. This NI FlexLogger usiReg URI File Parsing Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to create arbitrary files on affected installations of NI FlexLogger. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific fla

CVE-2024-6121 [HIGH] CVE-2024-6121: An out-of-date version of Redis shipped with NI SystemLink Server is susceptible to multiple vulnera An out-of-date version of Redis shipped with NI SystemLink Server is susceptible to multiple vulnerabilities, including CVE-2022-24834. This affects NI SystemLink Server 2024 Q1 and prior versions. It also affects NI FlexLogger 2023 Q2 and prior versions which installed this shared service.

CVE-2024-6122 [MEDIUM] CWE-276 CVE-2024-6122: An incorrect permission in the installation directory for the shared NI SystemLink Server KeyValueDa An incorrect permission in the installation directory for the shared NI SystemLink Server KeyValueDatabase service may result in information disclosure via local access. This affects NI SystemLink Server 2024 Q1 and prior versions. It also affects NI FlexLogger 2023 Q2 and prior versions which installed this shared service.

CVE-2024-4044 [HIGH] CWE-502 CVE-2024-4044: A deserialization of untrusted data vulnerability exists in common code used by FlexLogger and Instr A deserialization of untrusted data vulnerability exists in common code used by FlexLogger and InstrumentStudio that may result in remote code execution. Successful exploitation requires an attacker to get a user to open a specially crafted project file. This vulnerability affects NI FlexLogger 2024 Q1 and prior versions as well as NI InstrumentStudio 2

CVE-2024-1155 [HIGH] CWE-276 CVE-2024-1155: Incorrect permissions in the installation directories for shared SystemLink Elixir based services ma Incorrect permissions in the installation directories for shared SystemLink Elixir based services may allow an authenticated user to potentially enable escalation of privilege via local access.

CVE-2024-1156 [HIGH] CWE-276 CVE-2024-1156: Incorrect directory permissions for the shared NI RabbitMQ service may allow a local authenticated u Incorrect directory permissions for the shared NI RabbitMQ service may allow a local authenticated user to read RabbitMQ configuration information and potentially enable escalation of privileges.

CVE-2023-5136 [MEDIUM] CWE-611 CVE-2023-5136: An incorrect permission assignment in the TopoGrafix DataPlugin for GPX could result in information An incorrect permission assignment in the TopoGrafix DataPlugin for GPX could result in information disclosure. An attacker could exploit this vulnerability by getting a user to open a specially crafted data file.

CVE-2022-24834 [HIGH] CWE-122 CVE-2022-24834: Redis is an in-memory database that persists on disk. A specially crafted Lua script executing in Re Redis is an in-memory database that persists on disk. A specially crafted Lua script executing in Redis can trigger a heap overflow in the cjson library, and result with heap corruption and potentially remote code execution. The problem exists in all versions of Redis with Lua scripting support, starting from 2.6, and affects only authenticated and au

CVE-2022-27237 [MEDIUM] CWE-79 CVE-2022-27237: There is a cross-site scripting (XSS) vulnerability in an NI Web Server component installed with sev There is a cross-site scripting (XSS) vulnerability in an NI Web Server component installed with several NI products. Depending on the product(s) in use, remediation guidance includes: install SystemLink version 2021 R3 or later, install FlexLogger 2022 Q2 or later, install LabVIEW 2021 SP1, install G Web Development 2022 R1 or later, or install Stat