CVE-2026-48140: NI grpc-device Enum Cast DoS Vulnerability – CVSS 6.5

Technical summary

The vulnerability stems from an unchecked enum cast in NI grpc-device's BeginSidebandStream RPC handler (CWE-704: Incorrect Type Conversion or Cast). The service fails to validate that supplied enumeration values fall within the defined range before casting and using them, allowing an attacker to introduce out-of-range integers that cause invalid state transitions or memory access violations. The flaw is reachable over the network by any authenticated user, making it a network-accessible denial-of-service vector with low attack complexity.

Business impact

Organizations deploying NI grpc-device as part of National Instruments Instrument Studio or standalone gRPC device servers face availability risk. A hostile internal user or compromised account can disrupt measurement, monitoring, or automation workflows by crashing the grpc-device service. In industrial or test environments where uptime is critical, repeated exploitation could impede production schedules. The medium CVSS score reflects the availability impact combined with the authentication requirement, limiting but not eliminating operational risk.

Affected systems

National Instruments grpc-device versions 2.17.0 and prior are vulnerable. This includes deployments of NI Instrument Studio that bundle grpc-device, as well as standalone ni_grpc_device_server installations. Users on version 2.17.0 or earlier should assume exposure. The vendor and version information provided is: ni instrumentstudio and ni ni_grpc_device_server. Verify your exact installed version against National Instruments' product documentation.

Exploitability

Exploitation requires network access to the grpc-device service and valid authentication credentials. An attacker must craft a gRPC message to BeginSidebandStream with an out-of-range enum value—a straightforward task for someone with API knowledge and valid account access. The attack is reliable and repeatable. However, unauthenticated remote exploitation is not possible. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog, indicating no public weaponized proof-of-concept or in-the-wild attacks at the time of publication.

Remediation

Update National Instruments grpc-device to a version newer than 2.17.0. Consult the National Instruments security advisory or product download portal for the latest patch. Additionally, implement network-level access controls to restrict which systems and users can reach the grpc-device service; limit exposure to trusted internal networks only. Monitor service logs for repeated connection failures or RPC errors that may indicate exploitation attempts.

Patch guidance

Obtain and deploy the latest patched version of NI grpc-device from National Instruments' official channels—verify against the vendor advisory for exact version numbers and supported platforms (Windows, Linux, etc.). If automatic updates are available through NI Instrument Studio, enable them. Test patches in a non-production environment first to confirm compatibility with dependent applications. Document the patching date and version for compliance tracking.

Detection guidance

Look for BeginSidebandStream RPC calls with unusual or negative enum parameter values in gRPC service logs. Monitor for unexpected service crashes or restarts correlated with incoming network traffic. Implement gRPC-level logging to capture message details. Check for repeated authentication failures or error conditions from the same source IP or user account. In network monitoring, watch for gRPC protocol anomalies or payloads that violate the expected schema. Alert on sudden spikes in service exceptions or 'invalid enum' errors.

Why prioritize this

Although classified as MEDIUM severity, this vulnerability should be patched promptly because it enables direct denial of service with low attack complexity and only modest credential requirements. In environments where grpc-device supports time-sensitive or production workflows, service unavailability has real operational cost. The authentication requirement prevents mass exploitation but does not exclude insider or lateral-movement threats. Prioritize patching if grpc-device is exposed to potentially untrusted users or network segments.

Risk score, explained

CVSS 3.1 score of 6.5 (MEDIUM) reflects: (1) Network accessibility (AV:N) reducing the barrier to attack; (2) low attack complexity (AC:L) since crafting an out-of-range enum is straightforward; (3) requirement for authenticated access (PR:L), which reduces scope; (4) high availability impact (A:H) from the denial-of-service outcome; (5) no confidentiality or integrity impact (C:N, I:N). The authentication prerequisite prevents it from achieving HIGH or CRITICAL scoring, but the reliable availability impact justifies MEDIUM and prompt remediation.

Frequently asked questions