Skip to main content

CISA: Mirion Medical NMIS BioDose vulnerabilities affect versions prior to 23.0

Source Decision Insights Threat Desk Published December 2, 2025 Companies 2
Human View Machine View

2 companies named across 9 categories, one of 204 articles referencing Microsoft. Previous coverage: Applied Digital leads $25 million funding for Corintis to enhance data center cooling technology (Dec 2025).

Companies mentioned

Best suited for

Persona
Security Operations Leader
Decision stage
Which to buy
Adoption curve
Early Majority
Industry
Health Care / Health Care Equipment & Services / Health Care Providers & Services

Our classification, not the publisher's statement. Best suited for, not only for.

Mirion Medical EC2 Software NMIS BioDose products prior to version 23.0 contain multiple vulnerabilities — including incorrect permission assignment, use of client-side authentication, and hard-coded credentials — that can enable modification of executables, unauthorized application and database access, and arbitrary code execution.

Affected product: EC2 Software NMIS BioDose: Versions prior to 23.0; NMIS/BioDose V22.02 and previous. Vulnerable components and conditions include insecure installation directory file permissions permitting modification of program executables and libraries; Windows share paths in networked installs when the embedded Microsoft SQLServer Express is used that expose the Structured Query Language (SQL) Server database and configuration files; reliance on a common SQL Server user with client-side password checks while the latest version introduces an option to use Windows user authentication; executable binaries containing plain-text hard-coded passwords; and the SQL user account 'nmdbuser' and other created accounts defaulting to the sysadmin role, which can enable remote code execution via certain built-in stored procedures. CVE-2025-64642: Common Vulnerability Scoring System (CVSS) v3.1 base score 8.0 (AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H); CVSS v4 base score 7.1 (AV:L/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N). CVE-2025-64298: CVSS v3.1 base score 8.4 (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H); CVSS v4 base score 8.6 (AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N). CVE-2025-61940: CVSS v3.1 base score 8.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L); CVSS v4 base score 8.7 (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N). CVE-2025-64778: CVSS v3.1 base score 7.3 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L); CVSS v4 base score 8.4 (AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N). CVE-2025-62575: CVSS v3.1 base score 8.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L); CVSS v4 base score 8.7 (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N).

If exploited successfully, an attacker could modify program executables, gain access to sensitive information, gain unauthorized access to the application, and execute arbitrary code.

Mirion Medical recommends users update to V23.0 or later. Users with an active support contract should update to the latest version through the software or contact Mirion Medical support directly.

CISA recommends minimizing network exposure for control system devices and ensuring they are not accessible from the Internet; locating control system networks and remote devices behind firewalls and isolating them from business networks; and, when remote access is required, using more secure methods such as Virtual Private Networks while keeping such technologies updated. CISA also advises performing proper impact analysis and risk assessment before deploying defensive measures, following internal procedures and reporting suspected malicious activity to CISA, and using available control systems security recommended practices and guidance on social engineering and phishing avoidance.

Blog post, originally published by CISA at cisa.gov.

Mentions

Structured data (JSON-LD)

The schema.org markup this page publishes for search engines and AI agents, exactly as they read it.

[
  {
    "@context": "https://schema.org",
    "@id": "https://decisioninsights.ai/#website",
    "@type": "WebSite",
    "name": "Decision Insights",
    "potentialAction": {
      "@type": "SearchAction",
      "target": {
        "@type": "EntryPoint",
        "urlTemplate": "https://decisioninsights.ai/search/?q={search_term_string}&submit=1"
      }
    },
    "publisher": {
      "@id": "https://decisioninsights.ai/#organization"
    },
    "url": "https://decisioninsights.ai"
  },
  {
    "@context": "https://schema.org",
    "@id": "https://decisioninsights.ai/#organization",
    "@type": "Organization",
    "contactPoint": {
      "@type": "ContactPoint",
      "contactType": "customer support",
      "email": "[email protected]"
    },
    "description": "Decision Insights is a Registry of technology companies, open source projects, and industry terms, built for people and for AI agents that need sourced, structured information.",
    "logo": {
      "@type": "ImageObject",
      "url": "https://wiretap-cdn-assets.nyc3.cdn.digitaloceanspaces.com/decision-insights/[email protected]"
    },
    "name": "Decision Insights",
    "parentOrganization": {
      "@type": "Organization",
      "name": "Wiretap Labs",
      "sameAs": [
        "https://www.linkedin.com/company/wiretap-labs",
        "https://www.crunchbase.com/organization/wiretap-labs"
      ],
      "url": "https://wiretaplabs.com"
    },
    "publishingPrinciples": "https://decisioninsights.ai/standards/",
    "sameAs": [
      "https://www.linkedin.com/company/decisioninsights"
    ],
    "url": "https://decisioninsights.ai"
  },
  {
    "@context": "https://schema.org",
    "@type": "BreadcrumbList",
    "itemListElement": [
      {
        "@type": "ListItem",
        "item": "https://decisioninsights.ai",
        "name": "Decision Insights",
        "position": 1
      },
      {
        "@type": "ListItem",
        "item": "https://decisioninsights.ai/records/",
        "name": "Records",
        "position": 2
      },
      {
        "@type": "ListItem",
        "item": "https://decisioninsights.ai/cisa-mirion-medical-nmis-biodose-vulnerabilities-affect-versions-prior-to-23-0/",
        "name": "CISA: Mirion Medical NMIS BioDose vulnerabilities affect versions prior to 23.0",
        "position": 3
      }
    ]
  },
  {
    "@context": "https://schema.org",
    "@id": "https://decisioninsights.ai/cisa-mirion-medical-nmis-biodose-vulnerabilities-affect-versions-prior-to-23-0/#blogposting",
    "@type": "BlogPosting",
    "about": {
      "@id": "https://decisioninsights.ai/registry/microsoft/#organization",
      "@type": "Organization",
      "mainEntityOfPage": "https://decisioninsights.ai/registry/microsoft/",
      "name": "Microsoft"
    },
    "audience": [
      {
        "@type": "Audience",
        "additionalType": "Persona",
        "audienceType": "Security Operations Leader"
      },
      {
        "@type": "Audience",
        "additionalType": "Adoption curve",
        "audienceType": "Early Majority"
      },
      {
        "@type": "Audience",
        "additionalType": "Industry",
        "audienceType": "Health Care / Health Care Equipment & Services / Health Care Providers & Services"
      }
    ],
    "author": {
      "@id": "https://decisioninsights.ai/author/decision-insights-threat-desk/#person",
      "@type": "Person",
      "name": "Decision Insights Threat Desk",
      "url": "https://decisioninsights.ai/author/decision-insights-threat-desk/"
    },
    "dateModified": "2026-08-27T10:32:14-06:00",
    "datePublished": "2025-12-02T11:48:34-07:00",
    "description": "Mirion Medical NMIS BioDose versions prior to 23.0 contain multiple vulnerabilities with assigned CVEs and CVSS scores.",
    "headline": "CISA: Mirion Medical NMIS BioDose vulnerabilities affect versions prior to 23.0",
    "isBasedOn": {
      "@type": "CreativeWork",
      "author": {
        "@type": "Person",
        "name": "CISA"
      },
      "sourceOrganization": {
        "@id": "https://decisioninsights.ai/registry/department-of-homeland-security/#organization",
        "@type": "Organization",
        "mainEntityOfPage": "https://decisioninsights.ai/registry/department-of-homeland-security/",
        "name": "Department of Homeland Security"
      },
      "url": "https://www.cisa.gov/news-events/ics-medical-advisories/icsma-25-336-01"
    },
    "keywords": [
      "Application",
      "Authentication",
      "Common Vulnerability Scoring System",
      "Database",
      "EC2",
      "Server",
      "Software",
      "Structured Query Language",
      "Vulnerabilities"
    ],
    "mainEntityOfPage": {
      "@id": "https://decisioninsights.ai/cisa-mirion-medical-nmis-biodose-vulnerabilities-affect-versions-prior-to-23-0/",
      "@type": "WebPage",
      "sdDatePublished": "2026-08-27",
      "sdPublisher": {
        "@id": "https://decisioninsights.ai/#organization"
      }
    },
    "mentions": [
      {
        "@id": "https://decisioninsights.ai/registry/department-of-homeland-security/cybersecurity-and-infrastructure-security-agency-cisa/#organization",
        "@type": "Organization",
        "mainEntityOfPage": "https://decisioninsights.ai/registry/department-of-homeland-security/cybersecurity-and-infrastructure-security-agency-cisa/",
        "name": "Cybersecurity and Infrastructure Security Agency (CISA)"
      },
      {
        "@id": "https://decisioninsights.ai/registry/microsoft/#organization",
        "@type": "Organization",
        "mainEntityOfPage": "https://decisioninsights.ai/registry/microsoft/",
        "name": "Microsoft"
      },
      {
        "@type": "SoftwareSourceCode",
        "name": "Express"
      }
    ],
    "publisher": {
      "@id": "https://decisioninsights.ai/#organization"
    }
  },
  {
    "@context": "https://schema.org",
    "@id": "https://decisioninsights.ai/author/decision-insights-threat-desk/#person",
    "@type": "Person",
    "description": "CISA advisories, vendor security bulletins, and CVE disclosures, summarized into sourced briefs. Produced under our Standards & Methodology.",
    "name": "Decision Insights Threat Desk",
    "sameAs": [
      "https://www.linkedin.com/showcase/decisioninsights/"
    ],
    "url": "https://decisioninsights.ai/author/decision-insights-threat-desk/"
  }
]

Is this your company? Get structured data for your own pages