Skip to content
OpenAdvisories
High ICSMA-25-336-01 5 CVEs

Mirion Medical EC2 Software NMIS BioDose

Published Dec 2, 2025 · Updated Dec 2, 2025

Vendor: Mirion Medical Product: EC2 Software NMIS BioDose

Summary

Successful exploitation of these vulnerabilities could allow an attacker to modify program executables, gain access to sensitive information, gain unauthorized access to the application, and execute arbitrary code.

Vulnerabilities 5

  • High 8.4
    CVE-2025-64298

    Mirion Medical EC2 Software NMIS BioDose Incorrect Permission Assignment for Critical Resource

    NMIS/BioDose V22.02 and previous version installations where the embedded Microsoft SQLServer Express is used are exposed in the Windows share accessed by clients in networked installs. By default, this directory has insecure directory paths that allow access…

    Mirion Medical EC2 Software NMIS BioDose
  • High 8.3
    CVE-2025-61940

    Mirion Medical EC2 Software NMIS BioDose Use of Client-Side Authentication

    NMIS/BioDose V22.02 and previous versions rely on a common SQL Server user account to access data in the database. User access in the client application is restricted by a password authentication check in the client software but the underlying database connec…

    Mirion Medical EC2 Software NMIS BioDose
  • High 8.3
    CVE-2025-62575

    Mirion Medical EC2 Software NMIS BioDose Incorrect Permission Assignment for Critical Resource

    NMIS/BioDose V22.02 and previous versions rely on a Microsoft SQL Server database. The SQL user account 'nmdbuser' and other created accounts by default have the sysadmin role. This can lead to remote code execution through the use of certain built-in stored …

    Mirion Medical EC2 Software NMIS BioDose
  • High 8.0
    CVE-2025-64642

    Mirion Medical EC2 Software NMIS BioDose Incorrect Permission Assignment for Critical Resource

    NMIS/BioDose V22.02 and previous versions' installation directory paths by default have insecure file permissions, which in certain deployment scenarios can enable users on client workstations to modify the program executables and libraries.

    Mirion Medical EC2 Software NMIS BioDose
  • High 7.3
    CVE-2025-64778

    Mirion Medical EC2 Software NMIS BioDose Use of Hard-coded Credentials

    NMIS/BioDose software V22.02 and previous versions contain executable binaries with plain text hard-coded passwords. These hard-coded passwords could allow unauthorized access to both the application and database.

    Mirion Medical EC2 Software NMIS BioDose

Revision history

  1. #1

    Initial Publication

References