CVE-2024-12740
Published: 27 January 2025
Summary
CVE-2024-12740 is a high-severity an unspecified weakness vulnerability in Ni (inferred from references). Its CVSS base score is 7.0 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Malicious File (T1204.002); ranked at the 11.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-2 (Flaw Remediation) and SI-5 (Security Alerts, Advisories, and Directives).
Deeper analysis
CVE-2024-12740 affects vision-related software from National Instruments (NI) that incorporates a third-party library for image processing. This library exposes several vulnerabilities which may result in arbitrary code execution. The vulnerability received a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H) and was published on 2025-01-27.
Exploitation requires local access and an attacker to convince a user to open a specially crafted file, with low attack complexity and no privileges needed. Successful attacks can achieve high impacts on confidentiality, integrity, and availability through arbitrary code execution.
NI has published a security advisory at https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/dependency-on-vulnerable-third-party-component-exposes-vulnerabi.html detailing the dependency on the vulnerable third-party component.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-51081
Vulnerability details
Vision related software from NI used a third-party library for image processing that exposes several vulnerabilities. These vulnerabilities may result in arbitrary code execution. Successful exploitation requires an attacker to get a user to open a specially crafted file.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Vulnerability triggers arbitrary code execution when a user opens a specially crafted local file, directly mapping to malicious file user execution.
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Requires timely installation of patches or updates to remediate the vulnerability in the third-party image processing library used by NI vision software, preventing arbitrary code execution.
Mandates receiving, disseminating, and acting on security advisories like the NI advisory for this vulnerable third-party component to enable patching.
Enforces validation of image file inputs to detect and block specially crafted files that exploit the third-party library vulnerabilities.