Loading vulnerability…
Hard-coded Credentials in Mirion NMIS/BioDose
CVE-2025-64778 is a hard-coded credentials vulnerability in Mirion NMIS/BioDose software V22.02 and earlier. Executable binaries contain plain-text hard-coded passwords, exposing embedded credentials to anyone able to access or inspect the software. According to the provided CISA/NVD information, these credentials can be used to gain unauthorized access to both the BioDose/NMIS application and its underlying database. The issue is classified as CWE-798 (Use of Hard-coded Credentials).
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can allow an attacker with local access and low privileges to recover the embedded passwords and use them to authenticate to the application and database without authorization. This can result in compromise of sensitive data stored in the application or database, unauthorized modification of data, and broader loss of confidentiality and integrity. The provided CVSS vectors also indicate potential availability impact.
If you can’t patch tonight, do this now.
If immediate upgrade is not possible, limit local access to systems running BioDose/NMIS, restrict access to the application binaries, and tightly control access to the associated database and credentials. Monitor for unauthorized application or database logins, review account usage tied to the exposed credentials, and rotate or replace any credentials that may be hard-coded where operationally possible. However, the definitive fix in the provided information is upgrading to Version 23.
Patch, then assume compromise.
Upgrade BioDose/NMIS to Version 23 or later. The provided content states that Mirion Medical addressed the cited issues and that all fixes are included in BioDose/NMIS Version 23.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.