PT-2025-48779 · Unknown+1 · Nmis/Biodose+1

CVE-2025-64298 · Published 2025-12-02 · Updated 2025-12-02

Positive Technologies (AI Summary)

CVSS v3.1

8.4

High

Base vector

AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions NMIS/BioDose versions prior to 22.02

Description Installations of NMIS/BioDose V22.02 and earlier versions utilizing the embedded Microsoft SQLServer Express are susceptible to information disclosure. The Windows share accessed by clients in networked installations contains insecure directory paths. These paths allow access to the SQL Server database and configuration files, potentially exposing sensitive data.

Recommendations Update to version 22.02 or later.

Fix

Incorrect Permission

Weakness Enumeration

CWE-732

Related Identifiers

CVE-2025-64298

Affected Products

Sql Server Express

Nmis/Biodose

References · 5

• https://osv.dev/vulnerability/CVE-2025-64298 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-64298 · Security Note
• https://cisa.gov/news-events/ics-medical-advisories/icsma-25-336-01 · Note
• https://t.me/CVEtracker/38721 · Telegram Post
• https://twitter.com/CVEnew/status/1995969417470001241 · Twitter Post