CVE-2023-4570: Improper Restriction in NI MeasurementLink Python Services
Impact An improper access restriction in NI MeasurementLink Python services could allow an attacker on an adjacent network to reach services exposed on localhost. These services were previously thought to be unreachable outside of the node. This affects measurement plug-ins written in Python using version 1.1.0 of the ni-measurementlink-service Python package and all previous versions.
Patches Upgrade all Python measurement plug-ins to use ni-measurementlink-service version 1.1.1 or later.
References Visit ni.com/info and enter the info code cve-2023-4570 for more information.
Other sources
An improper access restriction in NI MeasurementLink Python services could allow an attacker on an adjacent network to reach services exposed on localhost. These services were previously thought to be unreachable outside of the node. This affects measurement plug-ins written in Python using version 1.1.0 of the ni-measurementlink-service Python package and all previous versions.
Affected Software
Event History
Frequently Asked Questions
What is the impact of CVE-2023-4570?
An attacker on an adjacent network could reach services exposed on localhost, which were thought to be unreachable outside of the node.
What is the affected software for CVE-2023-4570?
The affected software is ni-measurementlink-service with versions 1.2.0.dev0 up to and including 1.2.0, as well as version 1.1.1.
What is the severity rating of CVE-2023-4570?
The severity rating of CVE-2023-4570 is 8.8 (high).
How can I fix CVE-2023-4570?
To fix CVE-2023-4570, update ni-measurementlink-service to version 1.2.0 or apply the available patch.
Where can I find more information about CVE-2023-4570?
You can find more information about CVE-2023-4570 in the following references: [GitHub Advisory](https://github.com/ni/measurementlink-python/security/advisories/GHSA-3f48-9j7q-q2gv), [NVD](https://nvd.nist.gov/vuln/detail/CVE-2023-4570), [GitHub Commit](https://github.com/ni/measurementlink-python/commit/3e9d45147befc9a151fca5582c64fa77c7ba1980).