CVE-2025-62575

Mirion Medical EC2 Software NMIS BioDose Incorrect Permission Assignment for Critical Resource

State: Published
Severity: 8.7 High
Published: Dec 2, 2025
Updated: Dec 2, 2025
Reserved: Nov 11, 2025

Description

NMIS/BioDose V22.02 and previous versions rely on a Microsoft SQL Server database. The SQL user account 'nmdbuser' and other created accounts by default have the sysadmin role. This can lead to remote code execution through the use of certain built-in stored procedures.

Scores

CVSS	Score	Vector	Source
4.0	8.7 High	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N	icscert
3.1	8.3 High	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L	icscert

Weaknesses

CWE-732 Incorrect Permission Assignment for Critical Resource

Affected Products

Product	Versions
EC2 Software NMIS BioDoseMirion Medical	before 23.0Affected 23.0Not affected

References

https://www.cisa.gov/news-events/ics-medical-advisories/icsma-25-336-01

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.