BaseFortify

Publication date: 2025-12-02

Last updated on: 2025-12-04

Assigner: ICS-CERT

Description

NMIS/BioDose V22.02 and previous versions rely on a Microsoft SQL Server database. The SQL user account 'nmdbuser' and other created accounts by default have the sysadmin role. This can lead to remote code execution through the use of certain built-in stored procedures.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-12-02

Last Modified

2025-12-04

Generated

2026-07-06

AI Q&A

2025-12-02

EPSS Evaluated

2026-07-05

NVD

CVE-2025-62575

EUVD

EUVD-2025-200320

Affected Vendors & Products

Vendor	Product	Version / Range
microsoft	sql_server	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-732	The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.

Attack-Flow Graph

Executive Summary

This vulnerability exists because NMIS/BioDose versions 22.02 and earlier use a Microsoft SQL Server database where the SQL user account 'nmdbuser' and other created accounts are assigned the sysadmin role by default. This excessive privilege allows an attacker to execute remote code by exploiting certain built-in stored procedures in the database.

Impact Analysis

The vulnerability can lead to remote code execution on the affected system, which means an attacker could potentially take full control of the database server and possibly the underlying system. This could result in data theft, data manipulation, service disruption, or further compromise of the network.

Hi! I’m here to help you understand CVE-2025-62575. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70