CVE-2025-35054

Summary

Newforma Info Exchange (NIX) stores credentials used to configure NPCS in 'HKLM\Software\WOW6432Node\Newforma<version>\Credentials'. The credentials are encrypted but the encryption key is stored in the same registry location. Authenticated users can access both the credentials and the encryption key. If these are Active Directory credentials, an attacker may be able to gain access to additional systems and resources.

Affected Software

VendorProductVersion RangeStatus
NewformaProject Center*affected
NewformaProject Center2024.3affected

Weaknesses

  • CWE-922: CWE-922 Insecure Storage of Sensitive Information
  • CWE-522: CWE-522 Insufficiently Protected Credentials
  • CWE-257: CWE-257 Storing Passwords in a Recoverable Format

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: partial

References