The vulnerability CVE-2026-9142 in NI grpc-device (<=2.17.0) arises from missing authentication controls on critical functions when TLS is not enabled and the server is bound to network interfaces beyond loopback. This insecure default credential scenario permits unauthenticated local network attackers to access the grpc-device server, potentially compromising confidentiality and integrity of the device communications. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) reflects network attack vector, low attack complexity, no privileges or user interaction required, and high impact on confidentiality and integrity.

An unauthenticated attacker on the local network can access the NI grpc-device server if TLS is not configured and the server is bound beyond loopback. This can lead to full compromise of confidentiality and integrity of the device's functions accessible via grpc-device. There is no impact on availability reported. No known exploits in the wild have been documented so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, ensure that TLS is properly configured on the grpc-device server and restrict server binding to the loopback interface to prevent unauthorized network access. Avoid exposing the grpc-device server on untrusted networks without authentication controls.