CVE-2025-35054CWE-257CWE-522CWE-922

CVE-2025-35054

Medium · published October 10, 2025

CVSS v3.1
5.3
EPSS
0%
Percentile
0.1
In the wild
Unconfirmed
What it is

Newforma Info Exchange (NIX) stores credentials used to configure NPCS in 'HKLM\Software\WOW6432Node\Newforma\<version>\Credentials'. The credentials are encrypted but the encryption key is stored in the same registry location. Authenticated users can access both the credentials and the encryption key. If these are Active Directory credentials, an attacker may be able to gain access to additional systems and resources.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00080 · 0.1th percentile
Weaknesses
CWE-257 · Storing Passwords in a Recoverable Format; CWE-522 · Insufficiently Protected Credentials; CWE-922 · Insecure Storage of Sensitive Information
Published
2025-10-10T01:15Z
Affected products (1)
ProductVersionsFixed in
newforma/project_center≤ 2024.3—
References (2)
https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-25-282-01.json · 9119a7d8-5eab-497f-8521-727c672e3725https://www.cve.org/CVERecord?id=CVE-2025-35054 · 9119a7d8-5eab-497f-8521-727c672e3725
EPSS history
Timeline
  • 09 OCT 20:20Z
    Newforma Info Exchange (NIX) insufficiently protected credentials
    cvelistv5