CVE-2025-35058

MediumCVSS 5.9/10Last modified Oct 8, 2026

Description

Newforma Info Exchange (NIX) '/UserWeb/Common/MarkupServices.ashx' allows a remote, unauthenticated attacker to cause NIX to make an SMB connection to an attacker-controlled system. The attacker can capture the NTLMv2 hash of the customer-configured NIX service account.

Metrics

CVSS 3.1 5.9/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-294

Affected software

Vendor	Product	Versions
Newforma	Project Center	< 2023.2

References

https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-25-282-01.jsonThird Party Advisory
https://www.cve.org/CVERecord?id=CVE-2025-35058Third Party Advisory

Timeline

Published: Oct 9, 2025
Last modified: Oct 8, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-350596.1Newforma Info Exchange (NIX) '/DownloadWeb/hyperlinkredirect.aspx' provides an unauthenticated URL redirect via the 'nhl' parameter.CVE-2025-35065.3Files to be deployed with agents are accessible without authentication in Checkmk 2.1.0, Checkmk 2.2.0, Checkmk 2.3.0 and <Checkmk 2.4.0b6 a CVE-2025-350605.4Newforma Info Exchange (NIX) provides a 'Send a File Transfer' feature that allows a remote, authenticated attacker to upload SVG files that CVE-2025-350615.9Newforma Info Exchange (NIX) '/NPCSRemoteWeb/LegacyIntegrationServices.asmx' allows a remote, unauthenticated attacker to cause NIX to make CVE-2025-350629.8Newforma Info Exchange (NIX) before version 2023.1 by default allows anonymous authentication which allows an unauthenticated attacker to ex CVE-2025-35086.5Certain HP DesignJet products may be vulnerable to information disclosure though printer's web interface allowing unauthenticated users to v CVE-2025-35097.2A Remote Code Execution (RCE) vulnerability was identified in GitHub Enterprise Server that allowed attackers to execute arbitrary code by e CVE-2025-35105.4The tagDiv Composer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple shortcodes in all versions up to, and inc CVE-2025-35117.5Improper Validation of Specified Quantity in Input vulnerability in Mitsubishi Electric Corporation CC-Link IE TSN Remote I/O module, CC-Lin CVE-2025-351124.9Agiloft Release 28 contains an XML External Entities vulnerability in any table that allows 'import/export', allowing an authenticated attac CVE-2025-351137.2Agiloft Release 28 does not properly neutralize special elements used in an EUI template engine, allowing an authenticated attacker to achie CVE-2025-351147.5Agiloft Release 28 contains several accounts with default credentials that could allow local privilege escalation. The password hash is know