CVE Intelligence
Analysis AI-assisted

CVE-2026-9142: NI grpc-device Server: Insecure Default Credentials Without TLS

NI grpc-device 2.17.0 and prior versions contain an insecure default credentials weakness (CWE-306) when no TLS configuration is present and the server is bound beyond loopback. The record rates it critical, with a CVSS 3.1 base score of 9.1 and a CVSS 4.0 score of 9.3, and states it may allow unauthenticated access on the local network. No confirmed exploitation appears in the sources consulted.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

NI grpc-device contains an insecure default credentials weakness classified as CWE-306, missing authentication for a critical function. According to the record, the issue applies when no TLS configuration is present and the server is bound beyond loopback.

Impact

  • The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N describes network reachability, low complexity, no privileges required, no user interaction, and high confidentiality and integrity impact.
  • The vendor-provided CVSS 3.1 base score is 9.1 and the CVSS 4.0 score is 9.3, both rated critical.
  • The record states exposure to the local network but does not describe which data or operations would be reachable.

Affected products and versions

  • NI grpc-device: the description covers 2.17.0 and prior versions, and the affected list shows versions below 2.18.0.
  • NI InstrumentStudio: the affected list shows 2025 and earlier, 2026-q1 and 2026-q2. The record does not explain how this product relates to the grpc-device weakness.

Exploitation status

The record shows this CVE is not listed in the CISA KEV catalog. No confirmed exploitation appears in the sources consulted.

Remediation and mitigation

  • Review the vendor advisory and the NI security bulletin to confirm the fixed version for your product line, since the record lists none.
  • Plan an upgrade beyond the affected range. Inference: releases from 2.18.0 onward fall outside the listed grpc-device range, but confirm this with the vendor.
  • Until patched, avoid binding the server beyond loopback where it is not required, and limit network access with host firewalls or network segmentation.
  • Where the product supports it, enable TLS and authentication as described in vendor documentation.

Detection guidance

  • Inventory systems running NI grpc-device and NI InstrumentStudio and record installed versions.
  • Review network listeners on hosts running the server to identify services bound beyond loopback.
  • Monitor inbound connections to the server from unexpected hosts on the local network and retain logs where available.

Limitations of the available information

  • No fixed version is listed in the record, so the 2.18.0 boundary is an inference from the affected range.
  • The record does not describe default ports, configuration option names or exact authentication behavior.
  • The relationship between NI InstrumentStudio and this weakness is unknown.
  • EPSS and SSVC data are not available in the record.

Frequently asked questions

Is this vulnerability being exploited in the wild?

The record does not list it in the CISA KEV catalog, and no confirmed exploitation appears in the sources consulted.

Which versions are affected?

The description covers NI grpc-device 2.17.0 and prior versions, and the affected list shows versions below 2.18.0. The record lists no fixed version, so check the vendor advisory.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.