What is the CVSS score of CVE-2025-64642?

CVE-2025-64642 has a CVSS 3.1 base score of 8.0 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H. EPSS exploitation probability: 0.0%.

How to fix or mitigate CVE-2025-64642?

Within 24 hours: Identify all systems running NMIS/BioDose V22.02 or earlier and assess deployment model (dedicated vs. shared workstations). Within 7 days: Apply vendor-released patch to all affected instances; for shared workstations, implement strict directory permission controls (restrict write access to administrators only). Within 30 days: Conduct file integrity verification on patched systems to confirm proper permission remediation and review access logs for unauthorized modification attempts.

CVE-2025-64642

EUVD-2025-200324 HIGH

Incorrect Permission Assignment for Critical Resource (CWE-732)

2025-12-02 ics-cert@hq.dhs.gov

Information Disclosure

8.0

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.0 HIGH

AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Apr 16, 2026 - 06:24 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

23.0

EUVD ID Assigned

Mar 15, 2026 - 14:04 euvd

EUVD-2025-200324

Analysis Generated

Mar 15, 2026 - 14:04 vuln.today

CVE Published

Dec 02, 2025 - 21:15 nvd

HIGH 8.0

DescriptionCVE.org

NMIS/BioDose V22.02 and previous versions' installation directory paths by default have insecure file permissions, which in certain deployment scenarios can enable users on client workstations to modify the program executables and libraries.