External risk intelligence

NI VeriStand Waveform Streaming Server Untrusted Data Deserialization RCE

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2024-6794

NI VeriStand is specialized software used for real-time testing and hardware-in-the-loop simulation. While the service is network-accessible, it is typically deployed within isolated laboratory, engineering, or industrial control network segments. It is not designed to be exposed to the public internet in common deployment patterns.

Deserialization

Ni Veristand

2024 and earlier2024

Halo Surface Signal: 2 out of 5 — less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability in NI VeriStand's waveform streaming server could allow an attacker to execute code remotely by sending a specially crafted message. This could potentially impact systems that use this software for real-time testing and simulation.

Untrusted data can lead to remote code execution.
Critical for systems handling real-time testing.
Confirm relevance and exposure for critical systems.

Attack Path

How an attacker could exploit the issue

An attacker can exploit a deserialization vulnerability in NI VeriStand's Waveform Streaming Server by sending a specially crafted network message. This bypasses the need for any prior access or authentication, potentially allowing the attacker to execute arbitrary code on the targeted system.

Network access is required.
A specially crafted message triggers the vulnerability.
Leads to remote code execution.

Live Threat

Current exploitation, exposure, and threat context

The NI VeriStand Waveform Streaming Server, when exposed to a network, could allow an attacker to execute arbitrary code by sending a specially crafted message. This could impact the integrity and availability of the real-time testing or simulation environment.

Server code execution.
Attacker sends a crafted message.
Compromise of testing or simulation integrity.

Operational Fix

Recommended remediation, mitigation, and detection steps

The NI VeriStand Waveform Streaming Server's deserialization vulnerability necessitates action from teams managing the VeriStand platform and its associated applications. The initial practical move involves locating all instances of VeriStand, assessing their network exposure and criticality, and identifying the system owners responsible for remediation planning.

Platform and application owners should lead remediation.
Verify affected systems and their network exposure.
Plan phased remediation based on risk assessment.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is NI VeriStand used for?

NI VeriStand is software specialized for real-time testing and hardware-in-the-loop simulation. Engineers use it to validate complex control systems and hardware components by creating virtual environments that mimic real-world inputs and operational behavior.

What does deserialization of untrusted data mean for CVE-2024-6794?

This vulnerability, classified as CWE-502, occurs when the software processes data from an untrusted source without proper verification. Because the application blindly trusts this input during the deserialization process, an attacker can manipulate the data structure to force the system to execute unauthorized code.

How is this vulnerability triggered?

The flaw is triggered when an attacker sends a specifically formatted network message to the Waveform Streaming Server. This process does not require the attacker to have pre-existing credentials or access to the system. Legitimate, non-malicious traffic that does not contain this specific, crafted structure will not trigger the vulnerability.

Do I need to worry if my system is internal?

While the CVE allows remote code execution, Halo Surface Signal notes that NI VeriStand is typically deployed within isolated laboratory, engineering, or industrial control networks. If your system is not exposed to the public internet, the practical risk is significantly lower, though it remains a concern if an attacker has gained access to your internal network.

When should I prioritize addressing this CVE?

You should begin by identifying all instances of VeriStand within your environment to determine which systems are most critical to your operations. Once inventoried, work with the relevant system owners to assess network exposure and plan a phased update or configuration change to secure the platform against unauthorized messages.

References

www.ni.com/en/support/security/available-critical-and-security-u…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.