External risk intelligence

NI VeriStand Remote Code Execution Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2024-6793

NI VeriStand is specialized software used for testing, simulation, and data acquisition in engineering and manufacturing environments. While the affected DataLogging Server component uses network communication, it is typically deployed within isolated laboratory, industrial, or internal test networks rather than exposed to the public internet.

Deserialization

Ni Veristand

2024 and earlier2024

Halo Surface Signal: 2 out of 5 — less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in NI VeriStand's DataLogging Server component that could allow remote code execution. This issue arises from the deserialization of untrusted data, meaning a specially crafted message could be sent to compromise the system. The main concern is confirming the relevance and exposure of this technology within your specific operational environment, as NI VeriStand is specialized software typically used in engineering and manufacturing settings rather than directly exposed to the internet.

Flaw lets attackers run code remotely.
It matters if you use NI VeriStand software.
Confirm if this specialized software is in use.

Attack Path

How an attacker could exploit the issue

An attacker could reach the vulnerable component by sending a specially crafted message over the network to the NI VeriStand DataLogging Server. This component is susceptible to deserialization of untrusted data, which, if successful, could lead to the attacker executing arbitrary code on the affected system.

Network access required for exposure.
Vulnerable data logging server component.
Potential for remote code execution.

Live Threat

Current exploitation, exposure, and threat context

A deserialization vulnerability in NI VeriStand's DataLogging Server could allow an attacker to execute arbitrary code remotely. This requires the attacker to send a specially crafted message to the server, with successful exploitation potentially leading to system compromise.

System code and data could be affected.
Malicious data could be sent over the network.
Remote code execution may occur.

Operational Fix

Recommended remediation, mitigation, and detection steps

The NI VeriStand DataLogging Server is the likely target for this deserialization vulnerability, potentially leading to remote code execution. Teams responsible for application engineering and infrastructure supporting test and simulation environments should lead the response. The critical first step is to identify all instances of NI VeriStand, confirm their exposure and criticality, and then prioritize remediation based on risk, coordinating with the vendor as needed.

Application and infrastructure teams own remediation.
Verify all NI VeriStand instances and exposure.
Plan updates, coordinate with vendor support.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is NI VeriStand used for?

NI VeriStand is specialized software designed for real-time testing, simulation, and data acquisition. Engineering teams rely on it to configure and run automated test systems, particularly when validating hardware performance in automotive, aerospace, and industrial manufacturing environments.

What does deserialization of untrusted data mean for CVE-2024-6793?

This weakness, categorized as CWE-502, occurs when an application takes data from an outside source and converts it into an object without sufficient validation. Because the software trusts this incoming data implicitly, an attacker can manipulate the process to execute unauthorized commands or code on the system.

How does an attacker trigger this vulnerability?

An attacker triggers this flaw by sending a specifically formatted, malicious message over the network to the DataLogging Server component. The vulnerability is not triggered by standard, legitimate data logging operations or by simply having the software installed; the server must actively receive and process the crafted, untrusted input.

Is my system at risk if it runs NI VeriStand?

According to Halo Surface Signal, risk is often lower for this technology because VeriStand is typically deployed within isolated laboratory or internal test networks. You should be most concerned if your instance is inadvertently connected to the public internet or an untrusted network segment, as this increases the potential for unauthorized network access.

What should I do if I use NI VeriStand?

Begin by auditing your infrastructure to locate all active instances of the software. Once identified, evaluate their network connectivity to ensure they are properly isolated. Prioritize the application of official vendor patches to remediate the vulnerability and coordinate with your internal engineering and IT support teams to manage the update process.

References

www.ni.com/en/support/security/available-critical-and-security-u…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.