NI Vision Development Module File vulnerable third-party component

Summaryinfo

A vulnerability identified as very critical has been detected in NI Vision Development Module, FlexRIO, -IMAQdx, Vision Acquisition Software, Vision Builder for Automated Inspection, Data Record AD and FRC Game Tools. Affected is an unknown function of the component File Handler. Performing a manipulation results in vulnerable third-party component. This vulnerability is cataloged as CVE-2024-12740. It is possible to initiate the attack remotely. There is no exploit available.

Detailsinfo

A vulnerability classified as very critical has been found in NI Vision Development Module, FlexRIO, -IMAQdx, Vision Acquisition Software, Vision Builder for Automated Inspection, Data Record AD and FRC Game Tools. This affects some unknown functionality of the component File Handler. The manipulation with an unknown input leads to a vulnerable third-party component vulnerability. CWE is classifying the issue as CWE-1395. The product has a dependency on a third-party component that contains one or more known vulnerabilities. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

Vision related software from NI used a third-party library for image processing that exposes several vulnerabilities. These vulnerabilities may result in arbitrary code execution. Successful exploitation requires an attacker to get a user to open a specially crafted file.

The weakness was shared by Kimiya. The advisory is shared at ni.com. This vulnerability is uniquely identified as CVE-2024-12740 since 12/17/2024. The exploitability is told to be easy. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. It demands that the victim is doing some kind of user interaction. Neither technical details nor an exploit are publicly available. The price for an exploit might be around USD $0-$5k at the moment (estimation calculated on 02/21/2026).

The vulnerability scanner Nessus provides a plugin with the ID 299671 (NI FlexRIO < 2025 Q1 Arbitrary Code Execution (CVE-2024-12740)), which helps to determine the existence of the flaw in a target environment.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the vulnerability database at Tenable (299671). If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Type

• Automation Software

Vendor

• NI

Name

• -IMAQdx
• Data Record AD
• FlexRIO
• FRC Game Tools
• Vision Acquisition Software
• Vision Builder for Automated Inspection
• Vision Development Module

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion