CVE-2025-64778: NMIS/BioDose software V22.02 and previous versions contain executable binaries with plain text hard-coded passwords. These hard-coded passwo

CVE-2025-64778 · Severity: high · CVSS 7.3 · Published 2025-12-02

Technologies: Mirion Nmis, Mirion Biodose\. Vendors: Mirion.

Executive brief

NMIS/BioDose software V22.02 and previous versions contain executable binaries with plain text hard-coded passwords. These hard-coded passwords could allow unauthorized access to both the application and database.

Affected products

mirion nmis
mirion biodose\

Related threats

NMIS/BioDose V22.02 and previous versions' installation directory paths by default have insecure file permissions, which in certain deployme
NMIS/BioDose V22.02 and previous version installations where the embedded Microsoft SQLServer Express is used are exposed in the Windows sha
NMIS/BioDose V22.02 and previous versions rely on a Microsoft SQL Server database. The SQL user account 'nmdbuser' and other created account
NMIS/BioDose V22.02 and previous versions rely on a common SQL Server user account to access data in the database. User access in the client