CVE-2025-35054

Newforma Info Exchange (NIX) insufficiently protected credentials

State: Published
Severity: 4.8 Medium
Published: Oct 9, 2025
Updated: Oct 10, 2025
Reserved: Apr 15, 2025

Description

Newforma Info Exchange (NIX) stores credentials used to configure NPCS in 'HKLM\Software\WOW6432Node\Newforma\<version>\Credentials'. The credentials are encrypted but the encryption key is stored in the same registry location. Authenticated users can access both the credentials and the encryption key. If these are Active Directory credentials, an attacker may be able to gain access to additional systems and resources.

Scores

CVSS	Score	Vector	Source
4.0	4.8 Medium	CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N	cisa-cg
3.1	5.3 Medium	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L	cisa-cg

Weaknesses

CWE-922 Insecure Storage of Sensitive Information
CWE-522 Insufficiently Protected Credentials
CWE-257 Storing Passwords in a Recoverable Format

Affected Products

Product	Versions
Project CenterNewforma	*Affected 2024.3Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.