CVE-2023-5136: Incorrect Permission Assignment in the TopoGrafix DataPlugin for GPX

Description

An incorrect permission assignment in the TopoGrafix DataPlugin for GPX could result in information disclosure. An attacker could exploit this vulnerability by getting a user to open a specially crafted data file.

Scores

CVSS scores of CVE-2023-5136, by who scored it
Scored by	CVSS	Score	Vector
NICNA (assigner)	3.1	Medium5.5	CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
NVDNVD · Modified	3.1	Medium5.5	CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

EPSS (exploitation in 30 days): 0.25% · top 83% of all CVEs (6 Nov 2026)
CISA SSVC: Exploitation: none · Automatable: no · Technical impact: partial

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 5.5.

Weakness

CWE-611 Improper Restriction of XML External Entity Reference (opens in a new tab)All about CWE-611 and its CVEs
CWE-732 (opens in a new tab)All about CWE-732 and its CVEs

Affected products

NI · TopoGrafix DataPlugin for GPX
- affected < 2023 Q4
NI · DIAdem
- affected < 2023 Q2
NI · VeriStand
- affected ≤ 2023 Q4
NI · FlexLogger
- affected ≤ 2023 Q4

References (1)

https://www.ni.com/en/support/documentation/supplemental/23/incorrect-permission-assignment-in-the-topografix-dataplug-for-gpx.html (opens in a new tab)x_transferred

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

[![CVE-2023-5136](https://trackcve.app/badge/CVE-2023-5136.svg)](https://trackcve.app/cve/CVE-2023-5136)

Record last updated 11 Jun 2025, 14:34 UTC.