What’s Vulnerable › Vulnerabilities

CVE-2022-27237

• Severity: medium (CVSS 6.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2022-04-21 · updated 2026-06-17
• Weakness: CWE-79

Description

There is a cross-site scripting (XSS) vulnerability in an NI Web Server component installed with several NI products. Depending on the product(s) in use, remediation guidance includes: install SystemLink version 2021 R3 or later, install FlexLogger 2022 Q2 or later, install LabVIEW 2021 SP1, install G Web Development 2022 R1 or later, or install Static Test Software Suite version 1.2 or later.

Affected products

• NI FlexLogger: 2021-r2, 2021-r3, 2021-r4
• NI G Web Development Software: 2021
• NI LabVIEW: 2021
• NI Static Test Software Suite: before 1.2 — fixed in 1.2
• NI SystemLink: 2020-r4, 2022-r1, 2022-r2

How to fix

Upgrade to a fixed version: NI Static Test Software Suite 1.2. Check the vendor advisory for mitigations.

References

• https://www.ni.com/en-us/support/documentation/supplemental/22/cross-site-scripting-vulnerability--in-ni-web-server-component.html
• https://www.ni.com/en-us/support/documentation/supplemental/22/cross-site-scripting-vulnerability--in-ni-web-server-component.html

Get alerted when CVE-2022-27237 or the next vulnerability affects your stack