CVE-2025-30398CWE-862broken-access-control

CVE-2025-30398

High ยท published November 11, 2025

CVSS v3.1
8.1
EPSS
1%
Percentile
57.5
In the wild
Unconfirmed
What it is

โšก An overlooked authorization gap in Nuance PowerScribe could let unauthorized users peek at sensitive info without breaking a sweat! ๐Ÿ“ก Think of it like a restaurant where the waiter accidentally leaves the door to the kitchen wide open โ€” anyone can stroll in and see the secret recipes without showing a reservation! This vulnerability can have serious consequences, exposing sensitive medical information over the network. An attacker could access confidential patient data, leading to privacy breaches and potential compliance nightmares for healthcare providers.

Put simply

Think of it like a restaurant where the waiter accidentally leaves the door to the kitchen wide open โ€” anyone can stroll in and see the secret recipes without showing a reservation! The missing authorization check in Nuance PowerScribe allows unauthorized users to access and disclose information across the network, bypassing intended security measures.

What to do

This vulnerability can have serious consequences, exposing sensitive medical information over the network. An attacker could access confidential patient data, leading to privacy breaches and potential compliance nightmares for healthcare providers. To protect against this vulnerability, ensure you update Nuance PowerScribe to the latest version, where this issue has been addressed. Additionally, review your authorization settings and apply strict access controls to sensitive data. You've got this! With a few simple steps, you can lock down your system and keep that kitchen door closed! ๐Ÿ›ก๏ธ

The record
Technical detail
CVSS v3.1
8.1 ยท HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00844 ยท 57.5th percentile
Weakness
CWE-862 ยท Missing Authorization
Published
2025-11-11T23:15Z
Affected products (20)
ProductVersionsFixed in
microsoft/nuance_powerscribe_360all versionsโ€”
microsoft/nuance_powerscribe_360all versionsโ€”
microsoft/nuance_powerscribe_360all versionsโ€”
microsoft/nuance_powerscribe_360all versionsโ€”
microsoft/nuance_powerscribe_360all versionsโ€”
microsoft/nuance_powerscribe_360all versionsโ€”
microsoft/nuance_powerscribe_360all versionsโ€”
microsoft/nuance_powerscribe_360all versionsโ€”
microsoft/nuance_powerscribe_360all versionsโ€”
microsoft/nuance_powerscribe_oneall versionsโ€”
microsoft/nuance_powerscribe_oneall versionsโ€”
microsoft/nuance_powerscribe_oneall versionsโ€”
microsoft/nuance_powerscribe_oneall versionsโ€”
microsoft/nuance_powerscribe_oneall versionsโ€”
microsoft/nuance_powerscribe_oneall versionsโ€”
microsoft/nuance_powerscribe_oneall versionsโ€”
microsoft/nuance_powerscribe_oneall versionsโ€”
microsoft/nuance_powerscribe_oneall versionsโ€”
microsoft/nuance_powerscribe_oneall versionsโ€”
microsoft/nuance_powerscribe_oneall versionsโ€”
References (1)
EPSS history
Timeline
  • 11 NOV 17:59Z
    Nuance PowerScribe 360 Information Disclosure Vulnerability
    cvelistv5