What is the CVSS score of CVE-2025-64298?

CVE-2025-64298 has a CVSS 3.1 base score of 8.4 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Windows are affected by CVE-2025-64298?

NMIS/BioDose V22.02 and earlier expose SQL Server databases and configuration files containing sensitive data through insecurely configured Windows network shares accessible to any networked client.. A patch is available.

How to fix or mitigate CVE-2025-64298?

Within 24 hours: Identify all NMIS/BioDose installations running V22.02 or earlier and verify Windows share permissions on the SQL Server directory-restrict read/write access to authorized administrators only. Within 7 days: Apply the latest NMIS/BioDose patch above V22.02 per vendor advisory and re-validate share permissions post-deployment. Within 30 days: Conduct an audit of accounts and configuration changes made during exposure window; rotate any credentials found in exposed configuration files.

Windows CVE-2025-64298

EUVD-2025-200323 HIGH

Incorrect Permission Assignment for Critical Resource (CWE-732)

2025-12-02 ics-cert@hq.dhs.gov

Windows Information Disclosure Microsoft Biodose Nmis Mirion

8.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.4 HIGH

AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Apr 16, 2026 - 06:24 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

23.0

EUVD ID Assigned

Mar 15, 2026 - 14:04 euvd

EUVD-2025-200323

Analysis Generated

Mar 15, 2026 - 14:04 vuln.today

CVE Published

Dec 02, 2025 - 21:15 nvd

HIGH 8.4

DescriptionCVE.org

NMIS/BioDose V22.02 and previous version installations where the embedded Microsoft SQLServer Express is used are exposed in the Windows share accessed by clients in networked installs. By default, this directory has insecure directory paths that allow access to the SQL Server database and configuration files, which can contain sensitive data.

Analysis

Technical ContextAI

Information disclosure occurs when an application inadvertently reveals sensitive data to unauthorized actors through error messages, logs, or improper access controls. This vulnerability is classified as Incorrect Permission Assignment for Critical Resource (CWE-732).