This vulnerability involves an untrusted pointer dereference in the NI grpc-device sideband streaming API, specifically triggered by a maliciously crafted Moniker protobuf message. Successful exploitation can cause arbitrary memory dereference, which may lead to remote code execution. The issue affects all versions up to and including 2.17.0. The CVSS 3.1 base score is 9.1, reflecting network attack vector, low attack complexity, no privileges or user interaction required, and high impact on confidentiality and integrity. No vendor advisory or patch information is currently available, and the product is not a cloud service, so remediation depends on vendor updates.

Exploitation of this vulnerability can allow an unauthenticated remote attacker to execute arbitrary code on the affected system by causing an arbitrary memory dereference through a crafted Moniker protobuf message. This compromises confidentiality and integrity of the system. Availability impact is not indicated. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting network access to the grpc-device service and monitor for suspicious activity related to protobuf message handling. No official remediation or temporary fix has been provided by the vendor as of now.