CVE-2025-35052 Newforma Info Exchange (NIX) shared hard-coded secret key
Attackers can use a shared hard-coded key to decrypt parameters, bypassing authentication to download files from Newforma Info Exchange installations.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-35052?
CVE-2025-35052 is a medium-severity vulnerability in Newforma Project Center, published on 9 Oct 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Newforma Info Exchange (NIX) uses a hard-coded key to encrypt certain query parameters. Some encrypted parameter values can specify paths to download files, potentially bypassing authentication and authorization, for example, the 'qs' parameter used in '/DownloadWeb/download.aspx'. This key is shared across NIX installations. NIX 2023.3 and 2024.1 limit the use of hard-coded keys.
Weakness: CWE-321
Which versions are affected by CVE-2025-35052?
It affects 1 product.
Products include Newforma Project Center.
How do I fix CVE-2025-35052?
No fix has been published for CVE-2025-35052 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-35052 being exploited?
There is no known exploitation of CVE-2025-35052 in the wild and no public exploit code.
Other vulnerabilities in Newforma Project Center
- CVE-2025-35050 Newforma Info Exchange (NIX) .NET unauthenticated deserialization
- CVE-2025-35055 Newforma Info Exchange (NIX) insecure file upload
- CVE-2025-35058 Newforma Info Exchange (NIX) forced NTLMv2 authentication via /UserWeb/Common/MarkupServices.ashx
- CVE-2025-35061 Newforma Info Exchange (NIX) forced NTLMv2 authentication via /NPCSRemoteWeb/LegacyIntegrationServices.asmx
- CVE-2025-35051 Newforma Project Center Server (NPCS) .NET unauthenticated deserialization
Sources
Also known as GHSA-2vjw-w57f-jmf6.