CVE-2026-9142
Insecure Default Credentials vulnerability in NI grpc-device when TLS configuration is not present
- State
- Published
- Severity
- 9.3 Critical
- Published
- Jun 19, 2026
- Updated
- Jun 22, 2026
- Reserved
- May 20, 2026
Description
There is an insecure default credentials vulnerability in NI grpc-device when TLS configuration is not present and the server is bound beyond loopback. This may allow an unauthenticated user access to the server on the local network. This affects NI grpc-device 2.17.0 and prior versions.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 9.3 Critical | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N | NI |
| 3.1 | 9.1 Critical | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N | NI |
Weaknesses
- CWE-306 Missing authentication for critical function
Affected Products
| Product | Versions |
|---|---|
grpc-deviceNI |
|
InstrumentStudioNI |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.