CVE-2025-62575
📋 TL;DR
This vulnerability in NMIS/BioDose V22.02 and earlier allows attackers with database access to execute arbitrary code through SQL Server stored procedures due to excessive default privileges. Systems using these medical software versions with Microsoft SQL Server are affected.
💻 Affected Systems
- NMIS/BioDose
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise leading to patient data theft, medical device manipulation, and ransomware deployment across the healthcare network.
Likely Case
Database takeover enabling data exfiltration, privilege escalation, and lateral movement within the medical IT environment.
If Mitigated
Limited impact if proper network segmentation and least privilege principles are enforced, though database integrity remains at risk.
🎯 Exploit Status
Exploitation requires database credentials but leverages well-known SQL Server stored procedures like xp_cmdshell
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Not specified in advisory
Vendor Advisory: https://www.cisa.gov/news-events/ics-medical-advisories/icsma-25-336-01
Restart Required: No
Instructions:
1. Review CISA advisory ICSMA-25-336-01
2. Contact vendor for updated version
3. Apply principle of least privilege to database accounts
4. Remove sysadmin role from application accounts
🔧 Temporary Workarounds
Remove sysadmin role from application accounts
windowsRevoke sysadmin privileges from 'nmdbuser' and other application database accounts, granting only necessary permissions
USE master;
ALTER SERVER ROLE sysadmin DROP MEMBER nmdbuser;
Disable dangerous stored procedures
windowsDisable or restrict access to built-in stored procedures like xp_cmdshell that enable command execution
EXEC sp_configure 'show advanced options', 1;
RECONFIGURE;
EXEC sp_configure 'xp_cmdshell', 0;
RECONFIGURE;
🧯 If You Can't Patch
- Implement strict network segmentation to isolate database servers from internet and untrusted networks
- Deploy database activity monitoring to detect suspicious stored procedure usage and privilege escalation attempts
🔍 How to Verify
Check if Vulnerable:
Check SQL Server for accounts with sysadmin role: SELECT name FROM sys.server_principals WHERE IS_SRVROLEMEMBER('sysadmin', name) = 1Check Version:
Check NMIS/BioDose version in application interface or consult vendor documentationVerify Fix Applied:
Verify 'nmdbuser' and application accounts no longer have sysadmin role using same query, and confirm xp_cmdshell is disabled📡 Detection & Monitoring
Log Indicators:
- SQL Server logs showing xp_cmdshell or other dangerous stored procedure execution
- Failed login attempts to database accounts
- Unusual account privilege changes
Network Indicators:
- Unexpected outbound connections from database servers
- SMB or RDP connections originating from SQL Server
SIEM Query:
source="sql_server" AND (event_id=15457 OR event_id=33205 OR "xp_cmdshell" IN message)