Loading vulnerability…
Sensitive file exposure via insecure directory permissions in BioDose/NMIS embedded SQL Server Express
CVE-2025-64298 is an incorrect permission assignment vulnerability affecting NMIS/BioDose V22.02 and earlier, specifically installations that use the embedded Microsoft SQL Server Express deployment model. In affected networked installations, a Windows share accessed by clients exposes directory paths with insecure permissions. As a result, client-accessible paths can provide access to SQL Server database files and related configuration files. These files may contain sensitive information, and the issue stems from insecure default directory/path permissions on critical resources in the shared installation layout.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation allows unauthorized access to SQL Server database and configuration files exposed through the client-accessible Windows share. This can result in disclosure of sensitive data stored in the database or configuration, including information that may facilitate further compromise of the application environment or database-backed workflows. Based on the provided content, the primary confirmed impact is sensitive information exposure.
If you can’t patch tonight, do this now.
If immediate upgrade is not possible, restrict access to the Windows share used by clients, harden NTFS and share-level permissions on directories containing SQL Server database and configuration files, and ensure only authorized administrative or service accounts can access those resources. Limit network exposure of the share to only required systems and users, and review deployments using embedded SQL Server Express to identify and eliminate client access to sensitive backend files.
Patch, then assume compromise.
Upgrade BioDose/NMIS to Version 23, which Mirion Medical stated includes fixes for the vulnerabilities identified in the CISA advisory. For affected installations, review and correct permissions on the Windows share and the underlying directories containing SQL Server database and configuration files so that client users do not have unnecessary access to these critical resources. Remove or restrict exposure of embedded SQL Server files from client-accessible shared paths.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.