CVE-2025-64642

HighCVSS 7.8/10Last modified Sep 25, 2026

Description

NMIS/BioDose V22.02 and previous versions' installation directory paths by default have insecure file permissions, which in certain deployment scenarios can enable users on client workstations to modify the program executables and libraries.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-732

Affected software

VendorProductVersions
Mirion MedicalEC2 Software NMIS BioDose< 23.0

References

Timeline

Published
Dec 2, 2025
Last modified
Sep 25, 2026
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-646457.4IBM Concert 1.0.0 through 2.1.0 could allow a local user to escalate their privileges due to a race condition of a symbolic link.CVE-2025-646465.5IBM Concert 1.0.0 through 2.2.0 could allow an attacker to access sensitive information in memory due to the buffer not properly clearing reCVE-2025-646477.5IBM Concert 1.0.0 through 2.2.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive CVE-2025-646485.9IBM Concert 1.0.0 through 2.2.0 transmits data in clear text that could allow an attacker to obtain sensitive information using man in the mCVE-2025-646495.9IBM Concert 1.0.0 through 2.3.1 could allow a remote attacker to perform unauthorized actions using man in the middle techniques due to imprCVE-2025-64654.3Mattermost versions 10.8.x <= 10.8.3, 10.5.x <= 10.5.8, 10.10.x <= 10.10.0, 10.9.x <= 10.9.3 fail to sanitize file names which allows users CVE-2025-646506.5IBM Storage Defender - Resiliency Service 2.0.0 through 2.0.18 could disclose sensitive user credentials in log files.CVE-2025-646559.8Improper authorization in Dynamics OmniChannel SDK Storage Containers allows an unauthorized attacker to elevate privileges over a network.CVE-2025-646569.8Out-of-bounds read in Application Gateway allows an unauthorized attacker to elevate privileges over a network.CVE-2025-646579.8Stack-based buffer overflow in Azure Application Gateway allows an unauthorized attacker to elevate privileges over a network.CVE-2025-646587.5Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Shell allows an authorized attacker tCVE-2025-64669.8A vulnerability was found in ageerle ruoyi-ai 2.0.0 and classified as critical. Affected by this issue is the function speechToTextTranscrip