CVE-2025-62575 Overview
CVE-2025-62575 affects Mirion NMIS/BioDose V22.02 and earlier versions. The application relies on a Microsoft SQL Server backend where the nmdbuser SQL account and other accounts created during installation are assigned the sysadmin role by default. Authenticated attackers can abuse this configuration to execute operating system commands through built-in stored procedures such as xp_cmdshell. The flaw maps to CWE-732: Incorrect Permission Assignment for Critical Resource and was published in CISA Medical Advisory ICSMA-25-336-01.
Critical Impact
Authenticated attackers with access to the SQL Server instance can achieve remote code execution on the database host through sysadmin-level stored procedures.
Affected Products
- Mirion NMIS/BioDose V22.02
- Mirion NMIS/BioDose versions prior to V22.02
- Microsoft SQL Server instances hosting the nmdbuser account
Discovery Timeline
- 2025-12-02 - CVE-2025-62575 published to NVD
- 2026-01-02 - Last updated in NVD database
Technical Details for CVE-2025-62575
Vulnerability Analysis
NMIS/BioDose is a medical dosimetry information management system used to track radiation exposure for healthcare workers. The product provisions a Microsoft SQL Server database during installation and creates the nmdbuser account along with additional service accounts. Every account is granted the sysadmin fixed server role rather than scoped database-level permissions.
The sysadmin role permits unrestricted access to all SQL Server functionality, including extended stored procedures that interact with the operating system. An attacker who obtains credentials for nmdbuser or any other application account inherits full administrative control over the database engine and the underlying Windows host. Credential exposure is plausible because application service accounts are often embedded in configuration files, connection strings, or installer artifacts.
Root Cause
The root cause is insecure default configuration. The installer assigns the highest privilege role to functional accounts that only require data access. This violates the principle of least privilege described in [CWE-732].
Attack Vector
Exploitation requires network access to the SQL Server instance and valid credentials for an application account. Once authenticated, an attacker can invoke xp_cmdshell or similar extended stored procedures to spawn arbitrary commands under the SQL Server service account. Because the procedures are built into SQL Server, no additional malware delivery is required. The vulnerability mechanism is described in the CISA Medical Advisory ICSMA-25-336-01; no public proof-of-concept code has been released.
Detection Methods for CVE-2025-62575
Indicators of Compromise
- Unexpected child processes of sqlservr.exe such as cmd.exe, powershell.exe, or rundll32.exe.
- SQL Server error log entries showing enablement of xp_cmdshell or sp_configure changes from the nmdbuser account.
- Outbound network connections originating from the SQL Server host to untrusted destinations.
Detection Strategies
- Audit SQL Server logins and enumerate accounts holding the sysadmin server role using sp_helpsrvrolemember 'sysadmin'.
- Enable SQL Server Audit to capture execution of extended stored procedures including xp_cmdshell, sp_OACreate, and xp_regwrite.
- Monitor endpoint telemetry for process lineage where sqlservr.exe spawns shell interpreters or scripting engines.
Monitoring Recommendations
- Forward SQL Server audit logs and Windows process creation events (Event ID 4688) to a centralized SIEM for correlation.
- Alert on any successful login by nmdbuser from sources outside the application server.
- Track configuration changes to xp_cmdshell and Ad Hoc Distributed Queries settings.
How to Mitigate CVE-2025-62575
Immediate Actions Required
- Inventory all SQL Server accounts created by NMIS/BioDose and identify any with the sysadmin role.
- Restrict network access to the SQL Server instance so that only the NMIS/BioDose application server can connect.
- Rotate passwords for nmdbuser and other application-created accounts and store them in a secrets manager.
- Contact Mirion support for vendor-specific remediation guidance referenced in CISA Medical Advisory ICSMA-25-336-01.
Patch Information
No vendor patch URL is listed in the NVD entry at the time of publication. Refer to the CISA Medical Advisory ICSMA-25-336-01 and contact Mirion directly for updated firmware or configuration packages.
Workarounds
- Remove the sysadmin role from nmdbuser and grant only the database-scoped roles required for application operation, such as db_datareader and db_datawriter.
- Disable xp_cmdshell using sp_configure 'xp_cmdshell', 0 and apply the change with RECONFIGURE.
- Segment the SQL Server host on a restricted VLAN and require multi-factor authentication for administrative access to the database server.
- Apply Windows host hardening so the SQL Server service account runs with the minimum privileges necessary.
# Configuration example - reduce nmdbuser privileges and disable xp_cmdshell
sqlcmd -S <server> -E -Q "ALTER SERVER ROLE sysadmin DROP MEMBER nmdbuser;"
sqlcmd -S <server> -E -Q "USE NMIS; CREATE USER nmdbuser FOR LOGIN nmdbuser; ALTER ROLE db_datareader ADD MEMBER nmdbuser; ALTER ROLE db_datawriter ADD MEMBER nmdbuser;"
sqlcmd -S <server> -E -Q "EXEC sp_configure 'show advanced options', 1; RECONFIGURE; EXEC sp_configure 'xp_cmdshell', 0; RECONFIGURE;"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
