CVE-2024-12742

High

Published: 06 March 2025

Published

06 March 2025

Modified

15 April 2026

KEV Added

—

Patch

—

CVSS Score 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS Score 0.0051 66.4th percentile

Risk Priority 16 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2024-12742 is a high-severity Deserialization of Untrusted Data (CWE-502) vulnerability in Ni (inferred from references). Its CVSS base score is 7.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Client Execution (T1203); ranked in the top 33.6% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-2 (Flaw Remediation) and SI-10 (Information Input Validation).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploitation for Client Execution (T1203) and 1 other technique. What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

SI-2 Flaw Remediation good match

prevent

Directly remediates the deserialization vulnerability by requiring timely application of vendor-provided critical security updates for NI G Web Development Software.

SI-10 Information Input Validation partial match

prevent

Requires validation of untrusted project file inputs prior to deserialization, addressing the root cause of CWE-502 exploitation.

SI-3 Malicious Code Protection partial match

preventdetect

Deploys malicious code protection mechanisms to prevent and detect arbitrary code execution resulting from successful deserialization.

MITRE ATT&CK Enterprise TechniquesAI

T1203 Exploitation for Client Execution Execution

Adversaries may exploit software vulnerabilities in client applications to execute code.

attack.mitre.org →

T1204.002 Malicious File Execution

An adversary may rely upon a user opening a malicious file in order to gain execution.

attack.mitre.org →

Why these techniques?

The deserialization vulnerability enables arbitrary code execution when a user opens a malicious project file, directly facilitating T1203 (Exploitation for Client Execution) and T1204.002 (User Execution: Malicious File).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

NVD Description

A deserialization of untrusted data vulnerability exists in NI G Web Development Software that may result in arbitrary code execution. Successful exploitation requires an attacker to get a user to open a specially crafted project file. This vulnerability affects G…

Web Development Software 2022 Q3 and prior versions.

Deeper analysisAI

CVE-2024-12742 is a deserialization of untrusted data vulnerability (CWE-502) in NI G Web Development Software that can lead to arbitrary code execution. The issue affects G Web Development Software 2022 Q3 and prior versions. It has a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) and was published on 2025-03-06.

Exploitation requires an attacker to trick a user into opening a specially crafted project file, as the attack vector is local with low complexity and no privileges required, though user interaction is necessary. Successful exploitation allows arbitrary code execution on the affected system, resulting in high impacts to confidentiality, integrity, and availability.

The official NI security advisory provides details on available critical and security updates for mitigation: https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/deserialization-of-untrusted-data-vulnerability-in-ni-g-web-deve.html.