CVE-2024-12742
Published: 06 March 2025
Description
An adversary may rely upon a user opening a malicious file in order to gain execution.
Security Summary
CVE-2024-12742 is a deserialization of untrusted data vulnerability (CWE-502) in NI G Web Development Software that can lead to arbitrary code execution. The issue affects G Web Development Software 2022 Q3 and prior versions. It has a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) and was published on 2025-03-06.
Exploitation requires an attacker to trick a user into opening a specially crafted project file, as the attack vector is local with low complexity and no privileges required, though user interaction is necessary. Successful exploitation allows arbitrary code execution on the affected system, resulting in high impacts to confidentiality, integrity, and availability.
The official NI security advisory provides details on available critical and security updates for mitigation: https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/deserialization-of-untrusted-data-vulnerability-in-ni-g-web-deve.html.
Details
- CWE(s)
MITRE ATT&CK Enterprise Techniques
Why these techniques?
The deserialization vulnerability enables arbitrary code execution when a user opens a malicious project file, directly facilitating T1203 (Exploitation for Client Execution) and T1204.002 (User Execution: Malicious File).