Loading vulnerability…
Remote Code Execution via Default SQL Server sysadmin Role in Mirion NMIS/BioDose
CVE-2025-62575 affects Mirion NMIS/BioDose V22.02 and earlier versions that rely on a Microsoft SQL Server database. By default, the SQL account 'nmdbuser' and other accounts created by the product are assigned the SQL Server sysadmin role. This is an insecure default permission assignment affecting a critical resource and is mapped to CWE-732. Because these accounts have excessive privileges, an attacker who can authenticate with one of them can abuse certain built-in Microsoft SQL Server stored procedures to achieve remote code execution on the database server. CISA advisory ICSMA-25-336-01 and the provided fact set indicate the issue is fixed in BioDose/NMIS Version 23.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can give an attacker high-impact control over the affected SQL Server instance and can lead to remote code execution through built-in stored procedures. Given the assigned sysadmin role, exploitation can also result in full compromise of the database environment, including unauthorized access to sensitive data and the ability to alter database contents or server configuration. The provided scoring reflects high confidentiality and integrity impact, with availability impact ranging from partial to high depending on the scoring source.
If you can’t patch tonight, do this now.
As an interim measure, audit SQL Server role assignments for BioDose/NMIS-related accounts and revoke sysadmin privileges from 'nmdbuser' and other application-created accounts where operationally feasible. Restrict network access to the SQL Server to only required application hosts and administrators, disable or tightly control use of dangerous built-in stored procedures where possible, rotate any exposed or default credentials, and monitor for suspicious execution of privileged SQL Server procedures and administrative actions. Segment the database server from untrusted networks and limit interactive or remote access paths to reduce exploitability.
Patch, then assume compromise.
Upgrade Mirion BioDose/NMIS to Version 23, which Mirion states includes fixes for the issues identified in the CISA advisory. Review all SQL Server accounts created by the application, especially 'nmdbuser' and any other default-created accounts, and remove sysadmin membership unless explicitly required. Reconfigure the application to use least-privilege database roles sufficient only for required application functions.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.