PT-2025-48778 · Unknown+1 · Nmis/Biodose+1

Published 2025-12-02 · Updated 2025-12-02 · CVE-2025-62575

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions NMIS/BioDose versions prior to 22.02

Description The software relies on a Microsoft SQL Server database where the SQL user account nmdbuser and other created accounts are assigned the 'sysadmin' role by default. This configuration can allow for remote code execution through the use of specific built-in stored procedures.

Recommendations Ensure the nmdbuser account and any other created accounts do not have the 'sysadmin' role assigned to them. Restrict the privileges of these accounts to the minimum necessary for their intended function.

Fix

RCE

Incorrect Permission

Weakness Enumeration

CWE-732

Related Identifiers

CVE-2025-62575

Affected Products

Sql Server

Nmis/Biodose

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2025-62575 · Security Note
• https://osv.dev/vulnerability/CVE-2025-62575 · Vendor Advisory
• https://cisa.gov/news-events/ics-medical-advisories/icsma-25-336-01 · Note
• https://t.me/CVEtracker/38720 · Telegram Post
• https://twitter.com/CVEnew/status/1995969414621970455 · Twitter Post