Loading vulnerability…
Client-side authentication bypass in Mirion Medical EC2 Software NMIS/BioDose
CVE-2025-61940 is a client-side authentication weakness in Mirion Medical EC2 Software NMIS/BioDose V22.02 and earlier. The product uses a common SQL Server user account for database access, while user restrictions are enforced by a password check in the client application rather than by the database itself. As a result, the underlying database connection always has access regardless of the client-side access control decision. This creates a trust boundary failure in which application-level authentication does not meaningfully constrain database operations. CISA classifies the issue as CWE-603 (Use of Client-Side Authentication).
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can allow an authenticated low-privilege attacker with network reachability to bypass intended application-level access restrictions and obtain direct access to database-backed information and functions available through the shared SQL Server account. Based on the provided scoring and advisory context, this can result in high confidentiality and integrity impact and limited availability impact, including unauthorized viewing and modification of sensitive data stored in the NMIS/BioDose database.
If you can’t patch tonight, do this now.
If immediate upgrade is not possible, reduce exposure by restricting network access to the SQL Server and application components to only required hosts and users, limiting database connectivity through segmentation and host-based controls, and reviewing SQL Server account permissions to minimize broad shared access where feasible. Prioritize deployment of Windows user authentication for database access when supported, and monitor for unauthorized database access patterns originating from client systems.
Patch, then assume compromise.
Upgrade to BioDose/NMIS Version 23 or later, as Mirion Medical states that fixes for the cited issues are included in Version 23. Configure the product to use Windows user authentication for database access so that database permissions are tied to individual user context rather than a shared account with broad access.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.