CVE-2025-64642
HighCVSS 8.0Exploitation Probability (EPSS)
Low risk2th percentile - higher than 2% of all known CVEs
Summary
NMIS/BioDose V22.02 and previous versions' installation directory paths by default have insecure file permissions, which in certain deployment scenarios can enable users on client workstations to modify the program executables and libraries.
Risk Assessment
Risk of unauthorized modification of program files, potentially leading to malicious code execution or application integrity compromise.
Recommendation
Adjust installation directory permissions to prevent write access by unprivileged users and update the software.
Other vulnerabilities in NMIS/BioDose
See all- CVE-2025-64778High
NMIS/BioDose software V22.02 and previous versions contain executable binaries with plain text hard-coded passwords. These hard-coded passwords could allow unauthorized access to both the application and database.
- CVE-2025-64298High
NMIS/BioDose V22.02 and previous installations using the embedded Microsoft SQL Server Express are exposed through a Windows share accessible to clients in networked installs. By default, this directory has insecure paths that allow access to the SQL Server database and configuration files, which may contain sensitive data.
- CVE-2025-62575High
NMIS/BioDose V22.02 and previous versions rely on a Microsoft SQL Server database. The SQL user account 'nmdbuser' and other created accounts by default have the sysadmin role.
- CVE-2025-61940High
NMIS/BioDose V22.02 and previous versions rely on a common SQL Server user account to access data in the database. User access in the client application is restricted by a password authentication check in the client software but the underlying database connection always has access. The latest version of NMIS/BioDose introduces an option to use Windows user authentication with the database, which would restrict this database connection.
Original NVD description (English source)
NMIS/BioDose V22.02 and previous versions' installation directory paths by default have insecure file permissions, which in certain deployment scenarios can enable users on client workstations to modify the program executables and libraries.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS