CVE-2025-35054 Newforma Info Exchange (NIX) insufficiently protected credentials
Authenticated users can decrypt stored Active Directory credentials from the registry, potentially gaining access to additional systems and resources.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-35054?
CVE-2025-35054 is a medium-severity vulnerability in Newforma Project Center, published on 9 Oct 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Newforma Info Exchange (NIX) stores credentials used to configure NPCS in 'HKLM\Software\WOW6432Node\Newforma\<version>\Credentials'. The credentials are encrypted but the encryption key is stored in the same registry location. Authenticated users can access both the credentials and the encryption key. If these are Active Directory credentials, an attacker may be able to gain access to additional systems and resources.
Which versions are affected by CVE-2025-35054?
It affects 1 product.
Products include Newforma Project Center.
How do I fix CVE-2025-35054?
No fix has been published for CVE-2025-35054 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-35054 being exploited?
There is no known exploitation of CVE-2025-35054 in the wild and no public exploit code.
Other vulnerabilities in Newforma Project Center
- CVE-2025-35050 Newforma Info Exchange (NIX) .NET unauthenticated deserialization
- CVE-2025-35055 Newforma Info Exchange (NIX) insecure file upload
- CVE-2025-35058 Newforma Info Exchange (NIX) forced NTLMv2 authentication via /UserWeb/Common/MarkupServices.ashx
- CVE-2025-35061 Newforma Info Exchange (NIX) forced NTLMv2 authentication via /NPCSRemoteWeb/LegacyIntegrationServices.asmx
- CVE-2025-35051 Newforma Project Center Server (NPCS) .NET unauthenticated deserialization
Sources
Also known as GHSA-hg8f-f9vp-h6j2.