CVE-2024-1155 is a High severity incorrect permissions flaw, scored 7.8, in the installation directories of shared NI SystemLink Elixir based services. An authenticated local user may escalate privileges. NI says to upgrade SystemLink Server to 2024 Q1 or later, or restrict folder access.
What's affected
NI's advisory lists these products as affected: SystemLink Server 2023 Q3 and prior, FlexLogger 2022 Q3 and prior, G Web Development Software (all editions) 2022 Q3 and prior, Static Test Software Suite 1.2 and prior, LabVIEW NXG 5.1 (Web Module, Real-Time Module and Community Edition), Data Record AD 2.0.1 and prior, STS Software Bundle 21.0 and prior, and Specification Compliance Manager 2023 Q4 and prior.
The record says incorrect permissions in the installation directories for shared SystemLink Elixir based services may allow an authenticated user to escalate privilege through local access.
The only fixed version NI names is SystemLink Server 2024 Q1 or later. For the other products it lists no fixed version and points to a mitigation. One oddity: the NVD record's product entries use Emerson as the vendor name for these NI products. I followed NI's advisory for the product list.
How to check if you're exposed
Check which of the listed NI products are installed. In the NI Package Manager, the installed packages and versions are listed. On Windows you can also look under Apps and features.
Then inspect the folders named in the advisory under Program Files\National Instruments\Shared\Skyline and ProgramData\National Instruments\Skyline\RabbitMQ. If the Users or Authenticated Users groups have access through inherited permissions, the host is exposed.
What to do now
- List hosts running SystemLink Server or the other affected NI software.
- Upgrade SystemLink Server to 2024 Q1 or later. NI strongly recommends this, via NI Package Manager or NI Software Downloads.
- If you cannot upgrade, run NI's systemlink-restrict-file-access.bat script as administrator for each directory that exists, or disable inheritance on each folder and remove the Users and Authenticated Users entries.
- Reboot the server afterwards, as NI instructs.
- For FlexLogger with SystemLink Server installed, upgrade SystemLink Server instead.
- Limit who has local accounts on these machines.
Why it matters
The classes are incorrect default permissions, CWE-276, and incorrect authorization, CWE-863. When a service runs with high privileges but its install folders are writable by ordinary users, anyone who can log in can change what the service runs.
The score of 7.8 reflects a local attack with high impact. On shared engineering workstations and lab servers where many people have accounts, local flaws matter. The record's KEV flag is false.
Quick check
Is there a fix for every affected product?
No. NI names a fixed version only for SystemLink Server (2024 Q1 or later). For the others it gives a permissions mitigation.
Does an attacker need to be local?
Yes. The record describes local access by an authenticated user.
Sources
- NI security advisory on incorrect permissions in SystemLink Elixir based services
- NVD record and references for CVE-2024-1155
Last reviewed: 19 October 2026.
