CVE-2023-4570 json
Improper Restriction in NI MeasurementLink Python Services
published 2023-10-05 3 y ago modified 2026-07-07 4 mo ago also GHSA-3f48-9j7q-q2gv , PYSEC-2026-1695 , EUVD-2023-2628
- cvss
- 8.8
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.3%
- EPSS 0.3% chance of exploitation in 30 days, percentile 24%
- public exploits
- 0
- none known
Summary
An improper access restriction in NI MeasurementLink Python services could allow an attacker on an adjacent network to reach services exposed on localhost. These services were previously thought to be unreachable outside of the node. This affects measurement plug-ins written in Python using version 1.1.0 of the ni-measurementlink-service Python package and all previous versions.
Patch / fix
- pypi ni-measurementlink-service 1.1.1, 1.2.0
- ni measurementlink 1.1.1
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- total
- Assessed
- 2 y ago
Exploit prediction
0.32% chance of exploitation in the next 30 days, higher than 24% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 8.8 | CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| NVD | 3.1 | 8.8 | CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| OSV | 3.1 | 8.8 | CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| GitHub | 3.1 | 8.8 | CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | ni-measurementlink-service | <1.1.1 >=1.2.0.dev0, <1.2.0 |
1.1.1 1.2.0 |
Affected products
- NI MeasurementLink
Classification
- Weakness
-
- CWE-420 Unprotected Alternate Channel
References
-
github.com
/ni/measurementlink-python/commit/3e9d45147befc9a151fca5582c64fa77c7ba1980
web
-
github.com
/ni/measurementlink-python/commit/d2c73b1e0252081e1b89767aa916d73772d04dd9
web
-
ni.com
/en/support/documentation/supplemental/23/improper-restriction-in-ni-measurementlink-python-services.html
web, vendor-advisory
-
github.com
/ni/measurementlink-python/security/advisories/GHSA-3f48-9j7q-q2gv
web
-
nvd.nist.gov
/vuln/detail/CVE-2023-4570
advisory
-
github.com
/ni/measurementlink-python
package
-
pypi.org
/project/ni-measurementlink-service
package
-
github.com
/advisories/GHSA-3f48-9j7q-q2gv
advisory
Sources
- CVE List CVE-2023-4570
- GitHub Advisory GHSA-3f48-9j7q-q2gv
- NVD CVE-2023-4570
- OSV PYSEC-2026-1695
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.