What’s Vulnerable › Vulnerabilities

CVE-2023-5136: Incorrect Permission Assignment in the TopoGrafix DataPlugin for GPX

• Severity: medium (CVSS 5.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2023-11-08 · updated 2026-06-17
• Weakness: CWE-611

Description

An incorrect permission assignment in the TopoGrafix DataPlugin for GPX could result in information disclosure. An attacker could exploit this vulnerability by getting a user to open a specially crafted data file.

Affected products

• NI DIAdem: 2014, 2015, 2015-sp2, 2017, 2017-sp1, 2018 (+10)
• NI FlexLogger: 2018-r1, 2018-r2, 2018-r3, 2018-r4, 2019-r1, 2019-r2 (+16)
• NI Topografix Data Plugin: 2023
• NI VeriStand: 2013-sp1, 2014, 2015, 2015-sp1, 2016, 2017 (+19)

References

• https://www.ni.com/en/support/documentation/supplemental/23/incorrect-permission-assignment-in-the-topografix-dataplug-for-gpx.html
• https://www.ni.com/en/support/documentation/supplemental/23/incorrect-permission-assignment-in-the-topografix-dataplug-for-gpx.html

Get alerted when CVE-2023-5136 or the next vulnerability affects your stack