Vulnerability · Published Jun 19, 2026 · Assigned by NI
CVE-2026-9142Insecure Default Credentials vulnerability in NI grpc-device when TLS configuration is not present
Critical 9.1
In plain English
A critical-severity missing authentication in grpc-device from NI. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 38% of all known vulnerabilities).
Severity (CVSS 3.1)9.1Critical
Exploit odds (30 days)0.4%top 62.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
There is an insecure default credentials vulnerability in NI grpc-device when TLS configuration is not present and the server is bound beyond loopback. This may allow an unauthenticated user access to the server on the local network. This affects NI grpc-device 2.17.0 and prior versions.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| NI | grpc-device | 0 – through 2.17.0 |
| NI | InstrumentStudio | 0 – through 26.3.0 |
Weakness: CWE-306 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N