CVE-2025-64642CWE-732

CVE-2025-64642

High · published December 3, 2025

CVSS v3.1
8.0
EPSS
0%
Percentile
1.6
In the wild
Unconfirmed
What it is

⚡ Insecure file permissions in NMIS/BioDose can turn your program executables into open season for mischief! Think of it like leaving the back door of a restaurant wide open during service — anyone can stroll in and tamper with the kitchen without a second glance! If a user on a client workstation gets too cozy, they could modify critical program files, potentially leading to data corruption or even malicious code execution. The repercussions could be devastating, compromising the integrity of your entire application and user data.

Put simply

Think of it like leaving the back door of a restaurant wide open during service — anyone can stroll in and tamper with the kitchen without a second glance! This vulnerability stems from default installation directory paths in NMIS/BioDose V22.02 and earlier, which have inadequate file permissions. As a result, unauthorized users may modify the program executables and libraries on client workstations, leading to a serious security risk.

What to do

If a user on a client workstation gets too cozy, they could modify critical program files, potentially leading to data corruption or even malicious code execution. The repercussions could be devastating, compromising the integrity of your entire application and user data. To lock this down, review and tighten the file permissions on your installation directories immediately. Upgrade to the latest version of NMIS/BioDose that addresses this flaw, and regularly audit your software installations to ensure secure configurations. You've got this! With a few adjustments, you can fortify your setup and keep the kitchen safe from unwanted guests! 🛡️

The record
Technical detail
CVSS v3.1
8.0 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00118 · 1.6th percentile
Weakness
CWE-732 · Incorrect Permission Assignment for Critical Resource
Published
2025-12-03T02:15Z
Affected products (1)
ProductVersionsFixed in
mirion/biodose\/nmis< 23.023.0
References (1)
EPSS history
Timeline
  • 02 DEC 21:03Z
    Mirion Medical EC2 Software NMIS BioDose Incorrect Permission Assignment for Critical Resource
    cvelistv5