CVE-2025-64298

HighCVSS 7.5/10Last modified Sep 25, 2026

Description

NMIS/BioDose V22.02 and previous version installations where the embedded Microsoft SQLServer Express is used are exposed in the Windows share accessed by clients in networked installs. By default, this directory has insecure directory paths that allow access to the SQL Server database and configuration files, which can contain sensitive data.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-732

Affected software

Vendor	Product	Versions
Mirion Medical	EC2 Software NMIS BioDose	< 23.0

References

https://www.cisa.gov/news-events/ics-medical-advisories/icsma-25-336-01Third Party Advisory

Timeline

Published: Dec 2, 2025
Last modified: Sep 25, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-642992.7LogStare Collector improperly handles the password hash data. An administrative user may obtain the other users' password hashes.CVE-2025-64306.1When a file download is specified via the `Content-Disposition` header, that directive would be ignored if the file was included via a `<CVE-2025-643017.8An out‑of‑bounds write vulnerability exists in the EMF functionality of Canva Affinity. By using a specially crafted EMF file, an attacker c CVE-2025-643025.4Insufficient input sanitization in the dashboard label or path can allow an attacker to trigger a device error causing information disclosu CVE-2025-643045.1"FOD" App uses hard-coded cryptographic keys, which may allow a local unauthenticated attacker to retrieve the cryptographic keys.CVE-2025-643056.5MicroServer copies parts of the system firmware to an unencrypted external SD card on boot, which contains user and vendor secrets. An attac CVE-2025-643076.5The Brightpick Internal Logic Control web interface is accessible without requiring user authentication. An unauthorized user could exploit CVE-2025-643086.5The Brightpick Mission Control web application exposes hardcoded credentials in its client-side JavaScript bundle to Brightpick AI's documen CVE-2025-643097.4The affected product discloses device telemetry, configuration, and sensitive information via WebSocket traffic to unauthenticated users whe CVE-2025-64316.5When a link can be opened in an external application, Firefox for Android will, by default, prompt the user before doing so. An attacker cou CVE-2025-643109.8EPSON WebConfig and Epson Web Control for SEIKO EPSON Projector Products do not restrict excessive authentication attempts. An administrativ CVE-2025-643115.5Permission control vulnerability in the Notepad module. Impact: Successful exploitation of this vulnerability may affect service confidentia