CVE-2025-35052CWE-321

CVE-2025-35052

Medium · published October 10, 2025

CVSS v3.1

5.3

EPSS

Percentile

29.6

In the wild

Unconfirmed

What it is

Newforma Info Exchange (NIX) uses a hard-coded key to encrypt certain query parameters. Some encrypted parameter values can specify paths to download files, potentially bypassing authentication and authorization, for example, the 'qs' parameter used in '/DownloadWeb/download.aspx'. This key is shared across NIX installations. NIX 2023.3 and 2024.1 limit the use of hard-coded keys.

The record

Technical detail

CVSS v3.1: 5.3 · MEDIUM
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0: Not supplied
EPSS: 0.00369 · 29.6th percentile
Weakness: CWE-321 · Use of Hard-coded Cryptographic Key
Published: 2025-10-10T01:15Z

Affected products (1)

Product	Versions	Fixed in
newforma/project_center	≤ 2024.3	—

References (2)

https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-25-282-01.json · 9119a7d8-5eab-497f-8521-727c672e3725 https://www.cve.org/CVERecord?id=CVE-2025-35052 · 9119a7d8-5eab-497f-8521-727c672e3725

EPSS history

Timeline

09 OCT 20:20Z
Newforma Info Exchange (NIX) shared hard-coded secret key
cvelistv5