CVE-2024-12742
Published: 06 March 2025
Summary
CVE-2024-12742 is a high-severity Deserialization of Untrusted Data (CWE-502) vulnerability in Ni (inferred from references). Its CVSS base score is 8.4 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Client Execution (T1203); ranked in the top 33.3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-2 (Flaw Remediation) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2024-12742 is a deserialization of untrusted data vulnerability (CWE-502) in NI G Web Development Software that can lead to arbitrary code execution. The issue affects G Web Development Software 2022 Q3 and prior versions. It has a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) and was published on 2025-03-06.
Exploitation requires an attacker to trick a user into opening a specially crafted project file, as the attack vector is local with low complexity and no privileges required, though user interaction is necessary. Successful exploitation allows arbitrary code execution on the affected system, resulting in high impacts to confidentiality, integrity, and availability.
The official NI security advisory provides details on available critical and security updates for mitigation: https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/deserialization-of-untrusted-data-vulnerability-in-ni-g-web-deve.html.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-54011
Vulnerability details
A deserialization of untrusted data vulnerability exists in NI G Web Development Software that may result in arbitrary code execution. Successful exploitation requires an attacker to get a user to open a specially crafted project file. This vulnerability affects G…
more
Web Development Software 2022 Q3 and prior versions.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The deserialization vulnerability enables arbitrary code execution when a user opens a malicious project file, directly facilitating T1203 (Exploitation for Client Execution) and T1204.002 (User Execution: Malicious File).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly remediates the deserialization vulnerability by requiring timely application of vendor-provided critical security updates for NI G Web Development Software.
Requires validation of untrusted project file inputs prior to deserialization, addressing the root cause of CWE-502 exploitation.
Deploys malicious code protection mechanisms to prevent and detect arbitrary code execution resulting from successful deserialization.