What is the CVSS score of CVE-2025-62575?

CVE-2025-62575 has a CVSS 3.1 base score of 8.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L. EPSS exploitation probability: 0.3%.

Which versions of Microsoft are affected by CVE-2025-62575?

NMIS/BioDose V22.02 and earlier versions contain a critical privilege escalation vulnerability in their Microsoft SQL Server configuration where default database accounts possess sysadmin privileges,…. A patch is available.

How to fix or mitigate CVE-2025-62575?

Within 24 hours: Identify all systems running NMIS/BioDose V22.02 or earlier and isolate them from production networks if possible; document current version inventory. Within 7 days: Apply vendor-released patch to upgrade to V22.03 or later on all affected instances; verify sysadmin role removal from 'nmdbuser' and other service accounts post-upgrade. Within 30 days: Conduct SQL Server access audit across all NMIS/BioDose deployments; implement principle of least privilege for all database service accounts; establish change management process for future database permission reviews.

Microsoft CVE-2025-62575

EUVD-2025-200320 HIGH

Incorrect Permission Assignment for Critical Resource (CWE-732)

2025-12-02 ics-cert@hq.dhs.gov

RCE Microsoft

8.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.3 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

Low

Lifecycle Timeline

Analysis Updated

Apr 16, 2026 - 06:24 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

23.0

EUVD ID Assigned

Mar 15, 2026 - 14:04 euvd

EUVD-2025-200320

Analysis Generated

Mar 15, 2026 - 14:04 vuln.today

CVE Published

Dec 02, 2025 - 21:15 nvd

HIGH 8.3

DescriptionCVE.org

NMIS/BioDose V22.02 and previous versions rely on a Microsoft SQL Server database. The SQL user account 'nmdbuser' and other created accounts by default have the sysadmin role. This can lead to remote code execution through the use of certain built-in stored procedures.

Analysis

Technical ContextAI

Remote code execution allows an attacker to run arbitrary commands or code on the target system over a network without prior authentication. This vulnerability is classified as Incorrect Permission Assignment for Critical Resource (CWE-732).

RemediationAI

Apply vendor patches immediately. Restrict network access to vulnerable services. Implement network segmentation and monitoring for anomalous activity.