Critical Insecure Default Credentials Vulnerability in NI grpc-device

A critical vulnerability, CVE-2026-9142, has been identified in NI grpc-device affecting versions 2.17.0 and prior. This vulnerability arises from insecure default credentials when TLS configuration is absent, allowing unauthenticated users to access the server on local networks. The CVSS base score for this vulnerability is 9.1, indicating a high severity level. Organizations using NI grpc-device should be aware of the potential for unauthorized access due to this flaw. The vulnerability was published on June 19, 2026, and is currently unpatched. Immediate action is recommended to mitigate risks associated with this vulnerability. The scope of impact includes any systems running the affected versions of NI grpc-device.

Key Points: • CVE-2026-9142 is a critical vulnerability with a CVSS score of 9.1. • The flaw allows unauthenticated access to NI grpc-device servers on local networks. • Affected versions include NI grpc-device 2.17.0 and earlier, with no patch currently available.