CVE-2025-64298
HighCVSS 8.4Exploitation Probability (EPSS)
Low risk13th percentile - higher than 13% of all known CVEs
Summary
NMIS/BioDose V22.02 and previous installations using the embedded Microsoft SQL Server Express are exposed through a Windows share accessible to clients in networked installs. By default, this directory has insecure paths that allow access to the SQL Server database and configuration files, which may contain sensitive data.
Risk Assessment
Unauthorized network users could access sensitive data in the database and configuration files, potentially leading to information disclosure or system integrity compromise.
Recommendation
Secure network shares by restricting access to trusted users only. Change default directory paths and consider moving the database to a more secure location.
Other vulnerabilities in NMIS/BioDose
See all- CVE-2025-64778High
NMIS/BioDose software V22.02 and previous versions contain executable binaries with plain text hard-coded passwords. These hard-coded passwords could allow unauthorized access to both the application and database.
- CVE-2025-64642High
NMIS/BioDose V22.02 and previous versions' installation directory paths by default have insecure file permissions, which in certain deployment scenarios can enable users on client workstations to modify the program executables and libraries.
- CVE-2025-62575High
NMIS/BioDose V22.02 and previous versions rely on a Microsoft SQL Server database. The SQL user account 'nmdbuser' and other created accounts by default have the sysadmin role.
- CVE-2025-61940High
NMIS/BioDose V22.02 and previous versions rely on a common SQL Server user account to access data in the database. User access in the client application is restricted by a password authentication check in the client software but the underlying database connection always has access. The latest version of NMIS/BioDose introduces an option to use Windows user authentication with the database, which would restrict this database connection.
Original NVD description (English source)
NMIS/BioDose V22.02 and previous version installations where the embedded Microsoft SQLServer Express is used are exposed in the Windows share accessed by clients in networked installs. By default, this directory has insecure directory paths that allow access to the SQL Server database and configuration files, which can contain sensitive data.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS