CVE-2023-4570: NI MeasurementLink Python Services Improper Access Restriction Vulnerability
Summary
CVE-2023-4570: NI MeasurementLink Python Services Improper Access Restriction vulnerability. Affects ni-measurementlink-service across 2 version ranges.
< 1.1.1
>= 1.2.0.dev0, < 1.2.0
Fixed in 1.1.1 or 1.2.0, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The NI MeasurementLink Python services provide a platform for measurement plug-ins written in Python. These plug-ins allow users to interact with measurement devices and perform various data acquisition tasks. The ni-measurementlink-service Python package is used to facilitate communication between the measurement plug-ins and the underlying hardware. It is a popular package in the Python ecosystem and is widely used in various applications.
Vulnerability Detail
An improper access restriction vulnerability has been identified in the NI MeasurementLink Python services. This vulnerability allows an attacker on an adjacent network to access services that were previously thought to be unreachable outside of the node. The vulnerability affects measurement plug-ins written in Python using version 1.1.0 of the ni-measurementlink-service package and all previous versions. The impact of this vulnerability is significant as it enables unauthorized access to sensitive services and data, potentially leading to further exploitation and compromise of the system.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 1.1.11.1.1pip install --upgrade "ni-measurementlink-service==1.1.1" -
>= 1.2.0.dev0, < 1.2.01.2.0pip install --upgrade "ni-measurementlink-service==1.2.0"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Conclusion
The NI MeasurementLink Python services are vulnerable to an improper access restriction vulnerability, which allows unauthorized access to services exposed on localhost. To mitigate this risk, it is crucial to upgrade all Python measurement plug-ins to use version 1.1.1 or later of the ni-measurementlink-service package. Additionally, implementing network segmentation and firewall rules can provide temporary protection until the upgrade is performed. For further assistance and support in addressing this vulnerability, please contact DevNack.com.
See every vulnerability recorded for ni-measurementlink-service →
FAQ
The vulnerability allows an attacker on an adjacent network to access services exposed on localhost, which were previously thought to be unreachable outside of the node. This can lead to unauthorized access to sensitive services and data, potentially resulting in further exploitation and compromise of the system.
The vulnerability affects version 1.1.0 of the ni-measurementlink-service package and all previous versions.
As a temporary workaround, it is recommended to restrict network access to the affected services by implementing appropriate network segmentation and firewall rules. This can help limit the exposure of the vulnerable services to potential attackers.
At the time of this advisory, there are no known public exploits specifically targeting this vulnerability. However, it is important to promptly apply the recommended fix to prevent potential exploitation.
For more information about this vulnerability, you can visit ni.com/info and enter the info code 'cve-2023-4570'. This will provide additional details and resources related to the vulnerability.
