CVE-2025-62575
HighCVSS 8.3Exploitation Probability (EPSS)
Low risk34th percentile - higher than 34% of all known CVEs
Summary
NMIS/BioDose V22.02 and previous versions rely on a Microsoft SQL Server database. The SQL user account 'nmdbuser' and other created accounts by default have the sysadmin role.
Risk Assessment
This can lead to remote code execution through the use of certain built-in stored procedures.
Recommendation
Change default SQL account permissions by removing the sysadmin role from accounts such as 'nmdbuser' and apply the principle of least privilege.
Other vulnerabilities in NMIS/BioDose
See all- CVE-2025-64778High
NMIS/BioDose software V22.02 and previous versions contain executable binaries with plain text hard-coded passwords. These hard-coded passwords could allow unauthorized access to both the application and database.
- CVE-2025-64642High
NMIS/BioDose V22.02 and previous versions' installation directory paths by default have insecure file permissions, which in certain deployment scenarios can enable users on client workstations to modify the program executables and libraries.
- CVE-2025-64298High
NMIS/BioDose V22.02 and previous installations using the embedded Microsoft SQL Server Express are exposed through a Windows share accessible to clients in networked installs. By default, this directory has insecure paths that allow access to the SQL Server database and configuration files, which may contain sensitive data.
- CVE-2025-61940High
NMIS/BioDose V22.02 and previous versions rely on a common SQL Server user account to access data in the database. User access in the client application is restricted by a password authentication check in the client software but the underlying database connection always has access. The latest version of NMIS/BioDose introduces an option to use Windows user authentication with the database, which would restrict this database connection.
Original NVD description (English source)
NMIS/BioDose V22.02 and previous versions rely on a Microsoft SQL Server database. The SQL user account 'nmdbuser' and other created accounts by default have the sysadmin role. This can lead to remote code execution through the use of certain built-in stored procedures.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS