Loading vulnerability…
Insecure Installation Directory Permissions in NMIS/BioDose
CVE-2025-64642 is an incorrect permission assignment vulnerability affecting Mirion Medical EC2 Software NMIS/BioDose V22.02 and earlier. The issue arises because installation directory paths are created with insecure default file permissions. In certain deployment scenarios, this allows users on client workstations to modify program executables and libraries located in the installation path. The weakness is classified as CWE-732 (Incorrect Permission Assignment for Critical Resource) and effectively exposes trusted application binaries to unauthorized local modification.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation allows unauthorized modification of application executables and libraries, compromising the integrity of the NMIS/BioDose installation. This can enable binary replacement or tampering, potentially resulting in execution of attacker-controlled code in the context of the application or privileged processes that load the modified components. The vulnerability also creates risk of service disruption and limited confidentiality impact through compromise of the trusted application environment.
If you can’t patch tonight, do this now.
Restrict write access to all NMIS/BioDose installation directories, executables, and libraries. Apply secure filesystem permissions and verify that only authorized users can modify application binaries. Review deployment architecture to identify scenarios where client workstation users can reach or write to shared installation paths. Monitor for unauthorized changes to binaries and libraries, and use application whitelisting or file integrity monitoring where feasible.
Patch, then assume compromise.
Upgrade to BioDose/NMIS Version 23, which Mirion Medical stated includes fixes for the issues identified in the CISA advisory. In affected environments, correct the default permissions on installation directory paths so that only authorized administrative accounts and trusted service accounts can write to executables, libraries, and related application files. Review existing deployments for improperly inherited ACLs and remove write access for standard users on client workstations.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.