CVE-2023-5136 Incorrect Permission Assignment in the TopoGrafix DataPlugin for GPX
An attacker can disclose information by tricking a user into opening a specially crafted GPX file in NI products using the TopoGrafix DataPlugin.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2023-5136?
CVE-2023-5136 is a medium-severity vulnerability in NI DIAdem, published on 8 Nov 2023. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
An incorrect permission assignment in the TopoGrafix DataPlugin for GPX could result in information disclosure. An attacker could exploit this vulnerability by getting a user to open a specially crafted data file.
Which versions are affected by CVE-2023-5136?
It affects 4 products.
Products include Ni Diadem, Ni Flexlogger, Ni Topografix Data Plugin, Ni Veristand.
How do I fix CVE-2023-5136?
No fix has been published for CVE-2023-5136 yet. Limit exposure of the affected software until one is available.
Is CVE-2023-5136 being exploited?
There is no known exploitation of CVE-2023-5136 in the wild and no public exploit code.
Other vulnerabilities in NI DIAdem
Sources
Also known as GHSA-mjm5-8p7x-r4cv.