PT-2025-41478 · Newforma · Newforma Info Exchange

Adam Merrill + 6 · CVE-2025-35062 · Published 2025-10-09 · Updated 2025-10-22

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Newforma Info Exchange (NIX) versions prior to 2023.1

Description Newforma Info Exchange (NIX) versions prior to 2023.1, by default, permit anonymous authentication. This allows an unauthenticated attacker to exploit further issues that typically require authentication.

Recommendations Update to version 2023.1 or later.

Fix

Incorrect Default Permissions

Weakness Enumeration

CWE-276

Related Identifiers

CVE-2025-35062

Affected Products

Newforma Info Exchange

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2025-35062 · Security Note
• https://osv.dev/vulnerability/CVE-2025-35062 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-35062 · Security Note
• https://twitter.com/VulmonFeeds/status/1976530462584479952 · Twitter Post
• https://t.me/cveNotify/139866 · Telegram Post
• https://twitter.com/CVEnew/status/1976389902511022160 · Twitter Post
• https://t.me/cveNotify/139656 · Telegram Post
• https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-25-282-01.json · Note
• https://t.me/cveNotify/139879 · Telegram Post
• https://t.me/cveNotify/139907 · Telegram Post