PatchSiren

PatchSiren cyber security CVE debrief

CVE-2025-64642 Mirion Medical CVE debrief

CISA’s advisory for Mirion Medical EC2 Software NMIS BioDose says the product’s default installation directory permissions are insecure in certain deployment scenarios. On affected systems, a user on a client workstation may be able to modify program executables and libraries, creating an integrity risk for the application. Mirion Medical recommends updating to V23.0 or later.

Vendor
Mirion Medical
Product
EC2 Software NMIS BioDose
CVSS
HIGH 7.1
CISA KEV
Not listed in stored evidence
Original CVE published
2025-12-02
Original CVE updated
2026-09-25
Advisory published
2025-12-02
Advisory updated
2026-09-25

Who should care

Organizations running Mirion Medical EC2 Software NMIS BioDose, especially administrators responsible for client workstations, installation hardening, and software integrity in OT or medical environments.

Technical summary

The issue is a default file-permission weakness in the installation directory for NMIS/BioDose V22.02 and earlier. The advisory states that, in certain deployment scenarios, a user on a client workstation can modify program executables and libraries. The supplied CVSS vector is AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H, indicating a local attack path with meaningful integrity and availability impact.

Defensive priority

High. Prioritize if the product is deployed on client workstations or in environments where local users may have write access to application directories.

Recommended defensive actions

  • Update to V23.0 or later, per Mirion Medical’s recommendation.
  • If you have an active support contract, use the vendor’s supported update path or contact Mirion Medical support directly.
  • Review and tighten filesystem permissions on the NMIS/BioDose installation directory so only intended administrative accounts can modify executables and libraries.
  • Check affected workstations for unauthorized changes to installed binaries and libraries; reinstall from trusted media if integrity is uncertain.
  • Apply CISA ICS recommended practices and defense-in-depth guidance for hardening and access control on operational systems.

Evidence notes

The source corpus is the CISA CSAF advisory ICSMA-25-336-01 and its referenced materials. The advisory explicitly states that NMIS/BioDose V22.02 and previous versions have insecure default installation directory permissions and recommends updating to V23.0 or later. The supplied CVSS vector is AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H.

Sources and references

Verified primary and authoritative sources

  • CVE-2025-64642 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2025-64642

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2025-64642 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2025-64642

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2025/icsma-25-336-01.json

    cisa_csaf

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-medical-advisories/icsma-25-336-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/resources-tools/resources/ics-recommended-practices

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/topics/industrial-control-systems

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/uscert/sites/default/files/publications/emailscams0905.pdf

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/uscert/ncas/tips/ST04-014

    Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.