CVE-2025-35058 Newforma Info Exchange (NIX) forced NTLMv2 authentication via /UserWeb/Common/MarkupServices.ashx
Remote attackers can force the application to make SMB connections, capturing NTLMv2 hashes of the service account.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-35058?
CVE-2025-35058 is a high-severity server-side request forgery vulnerability in Newforma Project Center, published on 9 Oct 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Newforma Info Exchange (NIX) '/UserWeb/Common/MarkupServices.ashx' allows a remote, unauthenticated attacker to cause NIX to make an SMB connection to an attacker-controlled system. The attacker can capture the NTLMv2 hash of the customer-configured NIX service account.
Weakness: CWE-294
Which versions are affected by CVE-2025-35058?
It affects 1 product.
Products include Newforma Project Center.
How do I fix CVE-2025-35058?
No fix has been published for CVE-2025-35058 yet. Limit exposure of the affected software until one is available.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2025-35058 being exploited?
There is no known exploitation of CVE-2025-35058 in the wild and no public exploit code.
Other vulnerabilities in Newforma Project Center
- CVE-2025-35050 Newforma Info Exchange (NIX) .NET unauthenticated deserialization
- CVE-2025-35055 Newforma Info Exchange (NIX) insecure file upload
- CVE-2025-35061 Newforma Info Exchange (NIX) forced NTLMv2 authentication via /NPCSRemoteWeb/LegacyIntegrationServices.asmx
- CVE-2025-35051 Newforma Project Center Server (NPCS) .NET unauthenticated deserialization
- CVE-2025-35062 Newforma Info Exchange (NIX) default anonymous access
Sources
Also known as GHSA-xxg7-747h-w72j.