BaseFortify

Publication date: 2025-12-02

Last updated on: 2025-12-04

Assigner: ICS-CERT

Description

NMIS/BioDose V22.02 and previous version installations where the embedded Microsoft SQLServer Express is used are exposed in the Windows share accessed by clients in networked installs. By default, this directory has insecure directory paths that allow access to the SQL Server database and configuration files, which can contain sensitive data.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-12-02

Last Modified

2025-12-04

Generated

2026-07-06

AI Q&A

2025-12-02

EPSS Evaluated

2026-07-05

NVD

CVE-2025-64298

Affected Vendors & Products

Vendor	Product	Version / Range
microsoft	sql_server_express	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-732	The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.

Attack-Flow Graph

Executive Summary

This vulnerability affects NMIS/BioDose V22.02 and earlier versions when using the embedded Microsoft SQL Server Express in networked installations. The Windows share accessed by clients exposes the directory containing the SQL Server database and configuration files. These directories have insecure paths by default, allowing unauthorized access to sensitive database and configuration files.

Impact Analysis

The vulnerability can lead to unauthorized access to sensitive data stored in the SQL Server database and configuration files. This can result in data confidentiality, integrity, and availability being compromised, potentially allowing attackers to read, modify, or disrupt critical information.

Hi! I’m here to help you understand CVE-2025-64298. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70