External risk intelligence

NI VeriStand Gateway Missing Authorization Allows Remote Code Execution.

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2024-6806

NI VeriStand is specialized software used for test and measurement applications, typically deployed in engineering or laboratory environments. While the gateway component involves network communication, it is not traditionally designed as a public-facing internet service or edge gateway. Public exposure is possible in some specialized deployments, but it is not a standard internet-facing product role.

Remote Code Execution

Ni Veristand

2024 and earlier2024

Halo Surface Signal: 3 out of 5 — possibly public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A security vulnerability has been identified in NI VeriStand, a software used in test and measurement applications. The issue involves a failure to properly check authorization, which could allow unauthorized remote code execution. The main concern is confirming if this technology is in use and if it is exposed in a manner that could be exploited.

Unauthorized remote code could be run.
Understand potential risk to specialized systems.
Confirm relevance and exposure of NI VeriStand.

Attack Path

How an attacker could exploit the issue

An attacker could remotely access the NI VeriStand Gateway due to missing authorization checks. This exposure allows an unauthenticated actor to interact with Project resources, potentially leading to remote code execution.

Unauthenticated network access required.
Accessing Project resources triggers vulnerability.
Remote code execution is the risk.

Live Threat

Current exploitation, exposure, and threat context

The NI VeriStand Gateway might allow an unauthorized actor to remotely execute code due to missing authorization checks when accessing project resources. This could impact systems that use NI VeriStand, potentially affecting their operational integrity.

System project resources at risk.
Unauthorized remote access may occur.
Compromised service behavior and data integrity.

Operational Fix

Recommended remediation, mitigation, and detection steps

The NI VeriStand Gateway's missing authorization checks present a critical remote code execution risk, making it imperative for owners of NI VeriStand deployments to act. First, identify all instances of NI VeriStand, assess their network exposure and business criticality, and locate the accountable system or application owner. Remediation planning should then prioritize the most exposed and critical systems.

Ownership: NI VeriStand deployment owners.
Verify: Network exposure and asset criticality.
Action: Plan and coordinate targeted remediation.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is NI VeriStand used for?

NI VeriStand is specialized software designed for test and measurement applications. Engineering and research teams use it to create real-time testing environments, simulate hardware systems, and automate data collection in laboratory or manufacturing settings.

How does CVE-2024-6806 cause a security risk?

This vulnerability is classified as Improper Authorization (CWE-862). It occurs because the VeriStand Gateway fails to verify if a user has permission before allowing access to project resources. Without these checks, an attacker can bypass security controls to execute unauthorized code on the host system.

What triggers the VeriStand gateway vulnerability?

The flaw is triggered when an unauthorized actor attempts to access specific project resources through the gateway. Note that the vulnerability is tied to these resource interactions; simply having the software installed on a powered-off or isolated machine does not automatically trigger the remote code execution risk.

Is my NI VeriStand deployment at high risk?

Halo Surface Signal indicates that while this software is rarely intended for public internet exposure, its network-facing components could be reached if misconfigured. You should assess whether your specific laboratory or engineering network is accessible from broader corporate networks or the internet.

What steps should I take if I run this software?

Start by identifying every machine in your environment running VeriStand. Once you have an inventory, evaluate each system's network connectivity and operational importance. Coordinate with your technical leads to prioritize patching the most critical or exposed systems first.

References

www.ni.com/en/support/security/available-critical-and-security-u…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.