CVE-2025-64642: NMIS/BioDose V22.02 and previous versions' installation directory paths by default have insecure file permissions, which in certain deployme

CVE-2025-64642 · Severity: high · CVSS 8 · Published 2025-12-02

Technologies: Mirion Nmis, Mirion Biodose\. Vendors: Mirion.

Executive brief

NMIS/BioDose V22.02 and previous versions' installation directory paths by default have insecure file permissions, which in certain deployment scenarios can enable users on client workstations to modify the program executables and libraries.

Affected products

mirion nmis
mirion biodose\

Related threats

NMIS/BioDose software V22.02 and previous versions contain executable binaries with plain text hard-coded passwords. These hard-coded passwo
NMIS/BioDose V22.02 and previous version installations where the embedded Microsoft SQLServer Express is used are exposed in the Windows sha
NMIS/BioDose V22.02 and previous versions rely on a Microsoft SQL Server database. The SQL user account 'nmdbuser' and other created account
NMIS/BioDose V22.02 and previous versions rely on a common SQL Server user account to access data in the database. User access in the client