CVE-2025-35054 is a vulnerability identified in Newforma Project Center, specifically in the Newforma Info Exchange (NIX) component. The issue arises from the insecure storage of sensitive credentials in the Windows registry under the path 'HKLM\Software\WOW6432Node\Newforma\<version>\Credentials'. While the credentials are encrypted, the encryption key is stored in the same registry location, effectively nullifying the protection offered by encryption. This design flaw allows any user with authenticated access to the system and registry to retrieve both the encrypted credentials and the key, enabling decryption of the stored credentials. Since these credentials often include Active Directory accounts used to configure NPCS (Newforma Project Center Server), an attacker gaining access could leverage these credentials to move laterally within the network, accessing additional systems and sensitive resources. The vulnerability requires local authenticated access but does not require user interaction, and the attack vector is local (AV:L). The vulnerability affects all versions of Newforma Project Center, including version 2024.3. The CVSS v3.1 base score is 5.3, indicating medium severity, with impacts on confidentiality, integrity, and availability rated as low to medium. No patches or exploits are currently reported, but the vulnerability poses a significant risk in environments where multiple users have registry access and where Active Directory credentials are stored. The weakness is categorized under CWE-922 (Insecure Storage of Sensitive Information), CWE-522 (Insufficiently Protected Credentials), and CWE-257 (Storing Passwords in a Recoverable Format).

For European organizations, especially those in architecture, engineering, and construction sectors where Newforma Project Center is commonly used, this vulnerability could lead to unauthorized access to sensitive project data and internal systems. If attackers obtain Active Directory credentials, they could perform lateral movement, escalate privileges, and potentially access critical infrastructure or intellectual property. This could result in data breaches, operational disruptions, and reputational damage. The impact is heightened in organizations with multiple users having local authenticated access to systems running Newforma Project Center. Additionally, regulatory compliance risks arise under GDPR if personal or sensitive data is compromised. The medium severity score reflects that while exploitation requires authenticated access, the potential for privilege escalation and lateral movement within enterprise networks makes this a significant threat. Organizations with complex Active Directory environments and interconnected systems are particularly at risk.

To mitigate this vulnerability, European organizations should immediately restrict access to the affected registry keys to only highly trusted administrators and service accounts. Implement strict access control policies and audit registry access regularly to detect unauthorized attempts. Rotate and reset any Active Directory credentials stored in Newforma Project Center to invalidate compromised credentials. Consider isolating systems running Newforma Project Center from general user workstations to limit authenticated access. Employ endpoint detection and response (EDR) tools to monitor for suspicious registry access and lateral movement activities. Engage with Newforma for any forthcoming patches or updates and apply them promptly once available. Additionally, review and harden credential storage practices within the organization, avoiding storing sensitive credentials in recoverable formats. Conduct security awareness training to ensure users understand the risks of credential exposure. Finally, implement network segmentation to limit the impact of any credential compromise.