Mirion Medical EC2 Software NMIS BioDose Incorrect Permission Assignment for Critical Resource
Priority MEDIUM 40CWE-732Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · Low
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA.
Summary
NMIS/BioDose V22.02 and previous versions rely on a Microsoft SQL Server database. The SQL user account 'nmdbuser' and other created accounts by default have the sysadmin role. This can lead to remote code execution through the use of certain built-in stored procedures.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0045 39th percentileScored 2026-11-07
Fix Fixed EC2 Software NMIS BioDose (Mirion Medical): 23.0
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Mirion Medical | EC2 Software NMIS BioDose | before 23.0 | 23.0 | Patch available | CNA |
- EC2 Software NMIS BioDose VendorMirion Medical Affected before 23.0 Fixed in 23.0 Patch available CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:mirion:biodose\/nmis:*:*:*:*:*:*:*:* | before 23.0 | Vulnerable | Mirion Medical |
- cpe:2.3:a:mirion:biodose\/nmis:*:*:*:*:*:*:*:* Versions before 23.0 Vulnerable ·Mirion Medical
Remediation
- Fix · CNA EC2 Software NMIS BioDose (Mirion Medical) Fixed in 23.0
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
Mirion Medical EC2 Software NMIS BioDose 23.0
5 records Highest priority Priority MEDIUM 2 MEDIUM, 3 LOW
Other records, highest priority first
- TI-2025-38288 Mirion Medical EC2 Software NMIS BioDose Use of Client-Side AuthenticationPriority MEDIUM 40
- TI-2025-39738 Mirion Medical EC2 Software NMIS BioDose Incorrect Permission Assignment for Critical ResourcePriority LOW 39
- TI-2025-40112 Mirion Medical EC2 Software NMIS BioDose Use of Hard-coded CredentialsPriority LOW 35
Timeline
- 2026-10-02 Threatist record created from CVE-2025-62575
- 2026-10-03 Alias added: GHSA-959v-frv4-7fj8
References
More Mirion Medical Biodose/nmis vulnerabilities
- TI-2025-38288 Mirion Medical EC2 Software NMIS BioDose Use of Client-Side Authentication CVSS 4.0HIGH 8.7
- TI-2025-39738 Mirion Medical EC2 Software NMIS BioDose Incorrect Permission Assignment for Critical Resource CVSS 4.0HIGH 8.6
- TI-2025-40112 Mirion Medical EC2 Software NMIS BioDose Use of Hard-coded Credentials CVSS 4.0HIGH 8.4
- TI-2025-40009 Mirion Medical EC2 Software NMIS BioDose Incorrect Permission Assignment for Critical Resource CVSS 4.0HIGH 7.1
Sources
- CVE-2025-62575 · CVE Program
- CVE-2025-62575 · NVD
- FIRST EPSS
- GHSA-959v-frv4-7fj8 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences