CVE-2026-9142: Insecure Default Credentials vulnerability in NI grpc-device when TLS configuration is not present

Synopsis

An insecure default credentials vulnerability affects NI grpc-device version 2.17.0 and earlier, as well as NI InstrumentStudio version 26.3.0 and earlier. When TLS configuration is absent and the server is bound to a network interface beyond loopback, the gRPC device server accepts connections without requiring any credentials, exposing it to unauthenticated access on the local network. Successful exploitation allows an attacker to read sensitive data from and write arbitrary data to the server. No fix versions have been published yet; HarborGuard tracks the advisory and will make a patched rebuild available as soon as upstream ships a fix.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the gRPC device server over the network; the vulnerability is only exposed when the server is bound to an interface beyond loopback, making it reachable on the local network.

• AuthenticationNot required

  No credentials are required; the server accepts connections without any authentication when TLS configuration is absent.

• Victim interactionNot required

  No victim interaction is needed; the attacker contacts the server directly without requiring any action from a user.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special conditions, race conditions, or environmental setup beyond network access to the server.

Blast Radius

• An attacker reads data served by the gRPC device server, which may include instrument readings, device state, and configuration parameters.
• An attacker writes arbitrary data to the server, allowing manipulation of connected instrument or device behavior.
• Because confidentiality and integrity of the vulnerable component are both fully compromised, an attacker can combine read and write access to persistently alter device configuration or exfiltrate collected measurement data.