CVE-2023-5136: ni diadem
CVSS: 5.5v3.1MediumModified
Published 08-11-2023Last modified 11-06-2025
Vulnerability summary
CVE-2023-5136 is a medium (CVSS 5.5) vulnerability in ni diadem. EPSS estimates a 0.25% chance of exploitation in the next 30 days, higher than 15.8% of scored vulnerabilities.
CVSS score
5.5/10
010
Medium · v3.1 (CVE.org)EPSS score
0.25%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Timeline
- 08-11-2023PublishedVulnerability first disclosed.
- 11-06-2025Last modifiedVulnerability information updated.
Description
An incorrect permission assignment in the TopoGrafix DataPlugin for GPX could result in information disclosure. An attacker could exploit this vulnerability by getting a user to open a specially crafted data file.
CVSS metrics
2 scores · 2 sources · 1 versionMedium 5.5Preferred score · CVE.org (CNA)
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:NSourcesAll 2 agree
- NVDNIST5.5MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
EPSS trend
Probability
0.25%
Chance of exploitation in the next 30 days
Percentile
16%
Versus all other CVEs
30-day change
0.00 pp
From 0.25% on 21-09-2026
21-09-202621-10-2026
EPSS score0.25%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-611Improper Restriction of XML External Entity ReferenceThe product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.
- CWE-732Incorrect Permission Assignment for Critical ResourceThe product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.
Affected systems
Ni5 products
- diadem< 2023 Q2 | 2014 | 2015 | 2015:sp2 | 2017 | 2017:sp1 | 2018 | 2018:sp1 | 2019 | 2019:sp1 | 2020 | 2020:sp1 | 2021 | 2021:sp1 | 2022:q2 | 2022:q4 | 2023:q2
- flexlogger≤ 2023 Q4 | 2018:r1 | 2018:r2 | 2018:r3 | 2018:r4 | 2019:r1 | 2019:r2 | 2019:r3 | 2019:r4 | 2020:r1 | 2020:r2 | 2020:r3 | 2020:r4 | 2021:r1 | 2021:r2 | 2021:r3 | 2021:r4 | 2022:q2 | 2022:q4 | 2023:q1 | 2023:q2 | 2023:q3 | 2023:q4
- topografix_data_plugin2023
- topografix dataplugin for gpx< 2023 Q4
- veristand≤ 2023 Q4 | 2013:sp1 | 2014 | 2015 | 2015:sp1 | 2016 | 2017 | 2018 | 2018:sp1 | 2019 | 2019:r2 | 2019:r3 | 2019:r3f1 | 2020 | 2020:r2 | 2020:r3 | 2020:r4 | 2020:r5 | 2020:r6 | 2021 | 2021:r2 | 2021:r3 | 2023:q1 | 2023:q2 | 2023:q3 | 2023:q4
1 vendor · 5 products
References
1 links- www.ni.com/en/…Vendor Advisory