CVE-2023-4570: Improper Restriction in NI MeasurementLink Python Services
Vulnerability summary
CVE-2023-4570 is a high (CVSS 8.8) Unprotected Alternate Channel vulnerability in ni measurementlink. EPSS estimates a 0.32% chance of exploitation in the next 30 days, higher than 23.1% of scored vulnerabilities.
Timeline
- 05-10-2023PublishedVulnerability first disclosed.
- 19-09-2024Last modifiedVulnerability information updated.
Description
An improper access restriction in NI MeasurementLink Python services could allow an attacker on an adjacent network to reach services exposed on localhost. These services were previously thought to be unreachable outside of the node. This affects measurement plug-ins written in Python using version 1.1.0 of the ni-measurementlink-service Python package and all previous versions.
CVSS metrics
3 scores · 3 sources · 1 version- OSV · PypiEcosystem advisory · calculated8.8HighCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- NVDNIST8.8HighCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
0.32%
Chance of exploitation in the next 30 days
Percentile
23%
Versus all other CVEs
30-day change
Increase +0.03 pp
From 0.28% on 22-09-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Ni1 product
- measurementlink≥ 1.0.0, ≤ 1.1.0 | ≥ 1.0.0, < 1.1.1
PyPI1 product
- ni-measurementlink-service< 1.1.1 | ≥ 1.2.0.dev0, < 1.2.0
2 vendors · 2 products
