CVE-2025-64642 identifies a vulnerability in Mirion Medical's EC2 Software NMIS BioDose, versions 22.02 and earlier, where the installation directory paths have insecure default file permissions. Specifically, the permissions allow users on client workstations—who may not have administrative privileges—to modify program executables and libraries. This vulnerability is categorized under CWE-732, which involves incorrect permission assignments for critical resources. The insecure permissions create an attack vector for local users to perform unauthorized modifications, potentially leading to code tampering, privilege escalation, or execution of malicious payloads within the software environment. The vulnerability does not require authentication or user interaction, but exploitation is limited to local access (AV:L). The CVSS 4.0 vector indicates low attack complexity (AC:L), no privileges required (PR:N), no user interaction (UI:N), and significant impact on confidentiality (VC:L), integrity (VI:H), and availability (VA:H). Although no public exploits are currently known, the risk is elevated due to the critical role of NMIS BioDose in medical dose monitoring and management. The vulnerability's presence in installation directories suggests that default deployment practices may not enforce secure permissions, making it essential for organizations to audit and harden these settings. The lack of available patches at the time of publication further emphasizes the need for immediate compensating controls. Given the software's use in healthcare environments, exploitation could disrupt medical operations or compromise patient safety by altering dose measurement data or software behavior.

For European organizations, especially those in the healthcare sector using Mirion Medical's NMIS BioDose software, this vulnerability poses a significant risk. Unauthorized modification of executables and libraries can lead to system compromise, data integrity loss, and potential disruption of critical medical dose monitoring functions. This could result in incorrect radiation dose administration, endangering patient safety and violating regulatory compliance such as GDPR and medical device regulations. The local access requirement limits remote exploitation but does not mitigate risk in shared workstation environments or where insider threats exist. The integrity and availability impacts are high, potentially causing operational downtime or erroneous medical data. Additionally, compromised systems may serve as footholds for further lateral movement within hospital networks. The absence of known exploits reduces immediate threat but does not eliminate the risk of future targeted attacks. European healthcare providers must consider the criticality of this software in their operational technology and clinical workflows, prioritizing remediation to maintain patient safety and data trustworthiness.

1. Immediately audit file and directory permissions on all NMIS BioDose installations to ensure that only authorized administrators have write access to program executables and libraries. 2. Implement strict access control policies on client workstations, limiting local user permissions and preventing unauthorized modifications. 3. Employ application whitelisting or code integrity verification tools to detect and block unauthorized changes to software binaries. 4. Isolate workstations running NMIS BioDose from general user environments to reduce the risk of local privilege abuse. 5. Monitor file system changes and maintain logs for critical directories to detect suspicious activity promptly. 6. Engage with Mirion Medical for official patches or updates addressing this vulnerability and apply them as soon as they become available. 7. Conduct user training to raise awareness about the risks of local privilege misuse and enforce least privilege principles. 8. Where possible, deploy endpoint detection and response (EDR) solutions to identify anomalous behavior related to executable modifications. 9. Review and enhance physical security controls to prevent unauthorized physical access to client workstations. 10. Coordinate with regulatory compliance teams to document mitigation efforts and maintain audit readiness.