What is the CVSS score of CVE-2025-64642?

CVE-2025-64642 has a CVSS 3.1 base score of 8.0 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Biodose Nmis are affected by CVE-2025-64642?

NMIS/BioDose versions 22.02 and earlier contain insecure default file permissions in installation directories that could allow unauthorized modification of program executables and libraries on client…. A patch is available.

How to fix or mitigate CVE-2025-64642?

Within 24 hours: Identify all systems running NMIS/BioDose V22.02 or earlier and assess deployment model (dedicated vs. shared workstations). Within 7 days: Apply vendor-released patch to all affected instances; for shared workstations, implement strict directory permission controls (restrict write access to administrators only). Within 30 days: Conduct file integrity verification on patched systems to confirm proper permission remediation and review access logs for unauthorized modification attempts.

Biodose Nmis CVE-2025-64642

EUVD-2025-200324 HIGH

Incorrect Permission Assignment for Critical Resource (CWE-732)

2025-12-02 ics-cert@hq.dhs.gov

Information Disclosure Biodose Nmis Mirion

8.0

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.0 HIGH

AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Apr 16, 2026 - 06:24 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

23.0

EUVD ID Assigned

Mar 15, 2026 - 14:04 euvd

EUVD-2025-200324

Analysis Generated

Mar 15, 2026 - 14:04 vuln.today

CVE Published

Dec 02, 2025 - 21:15 nvd

HIGH 8.0

DescriptionCVE.org

NMIS/BioDose V22.02 and previous versions' installation directory paths by default have insecure file permissions, which in certain deployment scenarios can enable users on client workstations to modify the program executables and libraries.