CVE-2025-64298 Mirion Medical CVE debrief

Who should care

Operators and administrators running EC2 Software NMIS BioDose V22.02 or earlier, especially in networked deployments that use the embedded Microsoft SQL Server Express component, should treat this as a priority because the exposed share paths may reveal sensitive database and configuration data.

Technical summary

The advisory says that on NMIS/BioDose V22.02 and earlier, installations using the embedded Microsoft SQL Server Express are exposed via a Windows share accessed by clients in networked installs. The default directory layout permits access to SQL Server database files and configuration files. The supplied CVSS vector is CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, and the advisory recommends updating to V23.0 or later.

Defensive priority

High. The issue directly affects data confidentiality in a product used in networked environments, and the vendor recommends upgrading to a fixed version.

Recommended defensive actions

• Upgrade EC2 Software NMIS BioDose to V23.0 or later.
• If you have an active support contract, apply the latest vendor update through the software or contact Mirion Medical support.
• Review deployments that use the embedded Microsoft SQL Server Express component and verify that database and configuration paths are not exposed through accessible Windows shares.
• Restrict access to affected systems and shares to only necessary users and hosts until remediation is complete.
• Check for any sensitive data stored in the exposed database or configuration files and handle it according to your internal data protection procedures.

Evidence notes

All claims are drawn from the supplied CISA CSAF advisory and its remediation entry. The advisory states that NMIS/BioDose V22.02 and earlier installations using embedded Microsoft SQL Server Express are exposed in a Windows share, with insecure default directory paths that can expose SQL Server database and configuration files containing sensitive data. The source data includes a vendor remediation to update to V23.0 or later. The supplied enrichment also shows isKev=false and no threat entries.

Official resources