This script is Copyright (C) 2017 Tenable Network Security, Inc.
An application installed on the remote Windows host is affected by
an arbitrary code execution vulnerability.
The version of National Instruments (NI) LabVIEW installed on the
remote Windows host is version 2015 prior to 2015 SP1 f7 or 2016 prior
to 2016 f2. It is, therefore, affected by an arbitrary code execution
vulnerability in the LvVarientUnflatten functionality due to improper
validation of user-supplied input. An unauthenticated, remote attacker
can exploit this, by convincing a user to open a specially crafted VI
file, to cause a heap-based buffer overflow, allowing the execution of
See also :
Upgrade to NI LabVIEW version 2015 SP1 f7 (2015.1.7) / 2016 f2
(2016.0.2) or later.
Risk factor :
High / CVSS Base Score : 9.3
CVSS Temporal Score : 6.9
Public Exploit Available : false