Secuno
ENNL
Book demo

CVE-2025-61940

Mirion Biodose/nmis vulnerability

8.3 HIGHEPSS 0.32%
  1. Published2 Dec 2025

Description

NMIS/BioDose V22.02 and previous versions rely on a common SQL Server user account to access data in the database. User access in the client application is restricted by a password authentication check in the client software but the underlying database connection always has access. The latest version of NMIS/BioDose introduces an option to use Windows user authentication with the database, which would restrict this database connection.

CVSS 3.1 breakdown

Attack vectorNetwork
Attack complexityLow
Privileges requiredLow
User interactionNone
ScopeUnchanged
ConfidentialityHigh
IntegrityHigh
AvailabilityLow
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L

Affected products

Mirion Biodose/nmis< 23.0

Remediation

Fixed in
Mirion Biodose/nmis≥ 23.0

References

Related CVEs

Recent high-severity vulnerabilities sharing a weakness type.

CVE-2026-909838.2
Use of Client-Side authentication vulnerability in Hayat Health Facilities Inc. (Hayat…
CVE-2026-711879.8
The Ebyte device relies on client side authentication logic that can be reproduced by…
CVE-2026-13639.8
IAQS and I6 developed by JNC has a Client-Side Enforcement of Server-Side Security…
CVE-2025-128689.8
New Site Server developed by CyberTutor has a Use of Client-Side Authentication…
CVE-2025-626508.3
The Restaurant Brands International (RBI) assistant platform through 2025-09-06 relies…

Frequently asked

Is CVE-2025-61940 being actively exploited?

CVE-2025-61940 is not in the CISA KEV catalog. Its EPSS exploit probability is 0.32%.

How severe is CVE-2025-61940?

CVE-2025-61940 has a CVSS 3.1 base score of 8.3, rated high. EPSS estimates a 0.32% probability of exploitation.

Which products are affected by CVE-2025-61940?

Affected products include Mirion Biodose/nmis.

How do I fix CVE-2025-61940?

Upgrade affected software to a fixed version, for example Mirion Biodose/nmis 23.0 or later, then confirm no affected versions remain in your inventory.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2025-61940 against the real software inventory on every managed device, as each hourly inventory arrives. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation worksBook a demo

Get Patch this first every Monday

Five vulnerabilities that matter this week, ranked on real exploitation. Plain language, one email, no spam.

You can unsubscribe with one click from every issue. We handle your details as described in our privacy policy.

Data from the NVD, CISA KEV catalog and FIRST EPSS. CVSS 3.1 base score shown where available.