CVE-2025-35054
📋 TL;DR
Newforma Info Exchange (NIX) stores encrypted credentials with their encryption key in the same Windows registry location, allowing authenticated users to decrypt and access sensitive credentials. If these are Active Directory credentials, attackers could move laterally to other systems. This affects organizations using Newforma Info Exchange with NPCS configuration.
💻 Affected Systems
- Newforma Info Exchange (NIX)
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers gain domain administrator privileges through Active Directory credential theft, leading to full network compromise, data exfiltration, and ransomware deployment.
Likely Case
Authenticated attackers extract service account credentials to access additional systems and resources within the same network segment.
If Mitigated
Limited to credential exposure on the local system without lateral movement due to network segmentation and privileged access management.
🎯 Exploit Status
Requires authenticated Windows access to read registry keys and perform decryption operations.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check Newforma vendor advisory for specific version
Vendor Advisory: https://www.newforma.com/security-advisories/
Restart Required: No
Instructions:
1. Apply the latest Newforma Info Exchange update from vendor. 2. Verify registry permissions are properly restricted. 3. Rotate any exposed credentials.
🔧 Temporary Workarounds
Restrict Registry Permissions
WindowsModify Windows registry permissions to prevent non-administrative users from accessing the credential storage location.
regedit.exe
Navigate to HKLM\Software\WOW6432Node\Newforma\<version>\Credentials
Right-click → Permissions → Remove non-admin users
🧯 If You Can't Patch
- Implement strict access controls to limit who can log into NIX servers.
- Monitor registry access attempts to the Newforma credential storage location.
🔍 How to Verify
Check if Vulnerable:
Check if registry key HKLM\Software\WOW6432Node\Newforma\<version>\Credentials exists and contains both encrypted data and encryption key values.Check Version:
Check NIX application version through control panel or vendor documentation.Verify Fix Applied:
Verify registry permissions restrict access to administrators only and check for updated NIX version.📡 Detection & Monitoring
Log Indicators:
- Windows Security event logs showing registry access to Newforma credential paths by non-admin users
- Failed permission attempts to restricted registry keys
Network Indicators:
- Unusual authentication attempts from NIX server to other systems using service accounts
SIEM Query:
EventID=4656 AND ObjectName LIKE '%Newforma%Credentials%' AND SubjectUserName NOT IN (admin_users)