CVE-2025-64778 Overview
CVE-2025-64778 affects Mirion NMIS/BioDose software version V22.02 and earlier. The software ships executable binaries that embed plain-text hard-coded passwords [CWE-798]. An attacker with local access can extract these credentials from the binaries and use them to log in to both the application and its backing database. The issue impacts a medical device platform, so CISA published a medical advisory identifying the flaw. Successful exploitation grants access to patient dosimetry data and administrative functions without brute-forcing or phishing valid user accounts.
Critical Impact
Hard-coded credentials in NMIS/BioDose binaries permit local attackers to authenticate to the application and database, exposing sensitive medical data and configuration.
Affected Products
- Mirion NMIS/BioDose V22.02
- Mirion NMIS/BioDose versions prior to V22.02
- Deployments referenced in CISA advisory ICSMA-25-336-01
Discovery Timeline
- 2025-12-02 - CVE-2025-64778 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-64778
Vulnerability Analysis
The vulnerability stems from static credentials compiled into executable binaries shipped with NMIS/BioDose. Any user or process able to read the binaries on disk can recover the passwords using standard string extraction tools. The credentials authenticate to the NMIS/BioDose application and to the underlying database that stores patient dosimetry and configuration data. Because the passwords are identical across installations of the same version, one extraction compromises every deployment running V22.02 or earlier. The attack vector is local, and the attacker needs only low privileges on the host to read the affected files.
Root Cause
Developers embedded plain-text passwords directly into the compiled application code rather than storing them in a protected credential store or deriving them from per-installation secrets. The classification maps to [CWE-798] Use of Hard-coded Credentials. No password rotation, hashing, or per-instance salting mitigates the exposure.
Attack Vector
A local attacker with read access to the installation directory copies the executables and extracts embedded strings. The recovered credentials authenticate against the application's login prompt or connect directly to the database service. Once authenticated, the attacker reads or modifies dosimetry records, adjusts application settings, or pivots to other services that trust the database account. See the CISA Medical Advisory ICSMA-25-336-01 for vendor-supplied technical context.
Detection Methods for CVE-2025-64778
Indicators of Compromise
- Unexpected successful logins to NMIS/BioDose application accounts from local sessions or service accounts
- Direct database connections to the NMIS/BioDose backend from processes other than the application service
- Execution of string extraction utilities such as strings, floss, or Get-Content targeting NMIS/BioDose binaries
- Read access to NMIS/BioDose executable files by non-administrative users
Detection Strategies
- Baseline the processes and accounts that legitimately authenticate to the NMIS/BioDose database, then alert on deviations
- Monitor file access events on the NMIS/BioDose installation directory for reads by unauthorized users
- Correlate application authentication logs with host process telemetry to identify logins not initiated by the NMIS/BioDose service itself
Monitoring Recommendations
- Enable database audit logging for all authentication attempts and record source process and user context
- Forward application and database logs to a centralized platform for retention and correlation
- Track invocations of binary analysis tools on hosts running NMIS/BioDose
How to Mitigate CVE-2025-64778
Immediate Actions Required
- Restrict filesystem permissions on the NMIS/BioDose installation directory to the service account and administrators only
- Isolate NMIS/BioDose hosts on segmented network zones and block database ports from general user networks
- Contact Mirion for a fixed release and remediation guidance referenced in ICSMA-25-336-01
- Inventory all NMIS/BioDose deployments and identify systems running V22.02 or earlier
Patch Information
Mirion has not published a public patch URL in the referenced NVD entry. Operators should follow the remediation instructions in CISA advisory ICSMA-25-336-01 and coordinate directly with Mirion for a fixed build that removes the hard-coded credentials.
Workarounds
- Apply strict access control lists so only privileged accounts can read NMIS/BioDose executables
- Place the database on a dedicated host reachable only from the NMIS/BioDose application server
- Enforce host-based authentication policies that limit database logins to the expected application service account
- Monitor and log every authentication event to detect misuse of the embedded credentials until a fixed version is deployed
# Configuration example
# Restrict read access to NMIS/BioDose binaries on Windows
icacls "C:\Program Files\Mirion\NMIS" /inheritance:r
icacls "C:\Program Files\Mirion\NMIS" /grant:r "Administrators:(OI)(CI)F" "NMIS_Service:(OI)(CI)RX"
icacls "C:\Program Files\Mirion\NMIS" /remove "Users" "Authenticated Users"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
