CVE-2025-61940
HighCVSS 8.3Exploitation Probability (EPSS)
Low risk23th percentile - higher than 23% of all known CVEs
Summary
NMIS/BioDose V22.02 and previous versions rely on a common SQL Server user account to access data in the database. User access in the client application is restricted by a password authentication check in the client software but the underlying database connection always has access. The latest version of NMIS/BioDose introduces an option to use Windows user authentication with the database, which would restrict this database connection.
Risk Assessment
An individual with access to the client application can bypass password checks and gain direct access to all database data, leading to unauthorized data disclosure or modification.
Recommendation
Upgrade NMIS/BioDose to the latest version and enable the Windows user authentication option for the database to restrict the shared database connection.
Other vulnerabilities in NMIS/BioDose
See all- CVE-2025-64778High
NMIS/BioDose software V22.02 and previous versions contain executable binaries with plain text hard-coded passwords. These hard-coded passwords could allow unauthorized access to both the application and database.
- CVE-2025-64642High
NMIS/BioDose V22.02 and previous versions' installation directory paths by default have insecure file permissions, which in certain deployment scenarios can enable users on client workstations to modify the program executables and libraries.
- CVE-2025-64298High
NMIS/BioDose V22.02 and previous installations using the embedded Microsoft SQL Server Express are exposed through a Windows share accessible to clients in networked installs. By default, this directory has insecure paths that allow access to the SQL Server database and configuration files, which may contain sensitive data.
- CVE-2025-62575High
NMIS/BioDose V22.02 and previous versions rely on a Microsoft SQL Server database. The SQL user account 'nmdbuser' and other created accounts by default have the sysadmin role.
Original NVD description (English source)
NMIS/BioDose V22.02 and previous versions rely on a common SQL Server user account to access data in the database. User access in the client application is restricted by a password authentication check in the client software but the underlying database connection always has access. The latest version of NMIS/BioDose introduces an option to use Windows user authentication with the database, which would restrict this database connection.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS