CVE-2024-6805
📋 TL;DR
CVE-2024-6805 is an authorization bypass vulnerability in NI VeriStand Gateway that allows unauthorized actors to access File Transfer resources. This can lead to information disclosure or remote code execution. It affects NI VeriStand 2024 Q2 and all prior versions.
💻 Affected Systems
- NI VeriStand Gateway
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise, data theft, or disruption of industrial control systems.
Likely Case
Unauthorized file access and information disclosure from the VeriStand system.
If Mitigated
Limited impact with proper network segmentation and access controls in place.
🎯 Exploit Status
Missing authorization checks make exploitation straightforward once access to the gateway is obtained.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: NI VeriStand 2024 Q3 or later
Vendor Advisory: https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/missing-authorization-checks-in-ni-veristand-gateway.html
Restart Required: Yes
Instructions:
1. Download NI VeriStand 2024 Q3 or later from NI website. 2. Install the update following NI's installation guide. 3. Restart the VeriStand system and verify the update.
🔧 Temporary Workarounds
Network Segmentation
allIsolate VeriStand Gateway from untrusted networks and restrict access to authorized systems only.
Disable File Transfer
windowsIf File Transfer functionality is not required, disable it in VeriStand configuration.
🧯 If You Can't Patch
- Implement strict network access controls to limit who can reach the VeriStand Gateway
- Monitor for unauthorized file access attempts and implement additional authentication layers
🔍 How to Verify
Check if Vulnerable:
Check NI VeriStand version in the software interface or via Windows Programs and Features.Check Version:
Check NI VeriStand version in Windows Control Panel > Programs and FeaturesVerify Fix Applied:
Verify installed version is 2024 Q3 or later and test File Transfer functionality with unauthorized access attempts.📡 Detection & Monitoring
Log Indicators:
- Unauthorized access attempts to File Transfer resources
- Unexpected file operations from unauthenticated sources
Network Indicators:
- Unusual traffic patterns to VeriStand Gateway File Transfer endpoints
- File transfer requests from unauthorized IP addresses
SIEM Query:
source="veristand" AND (event="file_transfer" OR event="unauthorized_access")🔗 References
- https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/missing-authorization-checks-in-ni-veristand-gateway.html
- https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/missing-authorization-checks-in-ni-veristand-gateway.html
