What’s Vulnerable › Vulnerabilities

CVE-2026-9142: Insecure Default Credentials vulnerability in NI grpc-device when TLS configuration is not present

• Severity: critical (CVSS 9.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-06-19 · updated 2026-06-25
• Weakness: CWE-306

Description

There is an insecure default credentials vulnerability in NI grpc-device when TLS configuration is not present and the server is bound beyond loopback.  This may allow an unauthenticated user access to the server on the local network.  This affects NI grpc-device 2.17.0 and prior versions.

Affected products

• NI InstrumentStudio: through 2025; 2026-q1, 2026-q2
• Ni Grpc Device Server: before 2.18.0 — fixed in 2.18.0

How to fix

Upgrade to a fixed version: Ni Grpc Device Server 2.18.0. Check the vendor advisory for mitigations.

References

• https://github.com/ni/grpc-device/security/advisories/GHSA-fhhw-37q8-6562
• https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/2026/multiple-vulnerabilities-in-ni-grpc-device-server.html

Get alerted when CVE-2026-9142 or the next vulnerability affects your stack