Read the docs
TI-2025-24580 Aliases CVE-2025-35062GHSA-7vv3-f3c9-f6v6

Newforma Info Exchange (NIX) default anonymous access

Priority HIGH 70CWE-276Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
Low · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

Newforma Info Exchange (NIX) before version 2023.1 by default allows anonymous authentication which allows an unauthenticated attacker to exploit additional vulnerabilities that require authentication.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00368 30th percentileScored 2026-11-07
Fix Fixed Project Center (Newforma): 2023.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
NewformaProject Centerbefore 2023.12023.1Patch availableCNA
  • Project Center VendorNewforma Affected before 2023.1 Fixed in 2023.1 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:newforma:project_center:*:*:*:*:*:*:*:*before 2023.1VulnerableNewforma
  • cpe:2.3:a:newforma:project_center:*:*:*:*:*:*:*:* Versions before 2023.1 Vulnerable ·Newforma

Remediation

  • Fix · CNA Project Center (Newforma) Fixed in 2023.1

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Newforma Project Center 2023.1

    2 records Highest priority Priority HIGH 1 HIGH, 1 MEDIUM

    Other records, highest priority first

    • TI-2025-24573 Newforma Info Exchange (NIX) insecure file uploadPriority MEDIUM 40
    Show all 2 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-35062
  2. 2026-10-03 Alias added: GHSA-7vv3-f3c9-f6v6

References

Advisory 2

  • TI-2025-24568 Newforma Info Exchange (NIX) .NET unauthenticated deserialization CVSS 4.0CRITICAL 9.3
  • TI-2024-21387 Newforma Project Center Server through 2023.3.0.32259 allows remote code execution because .NET Remoting is exposed. CVSS 3.1CRITICAL 9.8
  • TI-2025-24573 Newforma Info Exchange (NIX) insecure file upload CVSS 4.0HIGH 8.7
  • TI-2025-24569 Newforma Project Center Server (NPCS) .NET unauthenticated deserialization CVSS 4.0HIGH 7.7
  • TI-2025-24579 Newforma Info Exchange (NIX) forced NTLMv2 authentication via /NPCSRemoteWeb/LegacyIntegrationServices.asmx CVSS 4.0HIGH 8.2
  • TI-2025-24576 Newforma Info Exchange (NIX) forced NTLMv2 authentication via /UserWeb/Common/MarkupServices.ashx CVSS 4.0HIGH 8.2
See all 13 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences