CVE-2025-64298

Mirion Medical EC2 Software NMIS BioDose Incorrect Permission Assignment for Critical Resource

State: Published
Severity: 8.6 High
Published: Dec 2, 2025
Updated: Dec 9, 2025
Reserved: Nov 11, 2025

Description

NMIS/BioDose V22.02 and previous version installations where the embedded Microsoft SQLServer Express is used are exposed in the Windows share accessed by clients in networked installs. By default, this directory has insecure directory paths that allow access to the SQL Server database and configuration files, which can contain sensitive data.

Scores

CVSS	Score	Vector	Source
4.0	8.6 High	CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N	icscert
3.1	8.4 High	CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	icscert

Weaknesses

CWE-732 Incorrect Permission Assignment for Critical Resource

Affected Products

Product	Versions
EC2 Software NMIS BioDoseMirion Medical	before 23.0Affected 23.0Not affected

References

https://www.cisa.gov/news-events/ics-medical-advisories/icsma-25-336-01

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.