Vulnerability · Published Jan 27, 2025 · Assigned by NI
CVE-2024-12740Dependency on Vulnerable Third-Party Component exposes Vulnerabilities in NI Vision Software
High 7.8
In plain English
A high-severity security flaw in Data Record AD from NI. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 9% of all known vulnerabilities).
Severity (CVSS 3.1)7.8High
Exploit odds (30 days)0.2%top 91.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Vision related software from NI used a third-party library for image processing that exposes several vulnerabilities. These vulnerabilities may result in arbitrary code execution. Successful exploitation requires an attacker to get a user to open a specially crafted file.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| NI | Vision Development Module | 0 – through 24.1 |
| NI | FlexRIO | 0 – before 25.0 |
| NI | NI-IMAQdx | 0 – through 23.1 |
| NI | Vision Acquisition Software | 0 – through 23.1 |
| NI | Vision Builder for Automated Inspection | 0 – through 23.* |
| NI | Data Record AD | 0 – through 2.0 |
| NI | FRC Game Tools | 0 – through 25.0 |
Weakness: CWE-1395 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H