Skip to content
CVE PROGRAM SOURCE RECORD6.0 Medium

CVE-2025-35057

Newforma Info Exchange (NIX) forced NTLMv2 authentication via /RemoteWeb/IntegrationServices.ashx

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
cisa-cg

Description

Newforma Info Exchange (NIX) '/RemoteWeb/IntegrationServices.ashx' allows a remote, unauthenticated attacker to cause NIX to make an SMB connection to an attacker-controlled system. The attacker can capture the NTLMv2 hash of the NIX service account.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Newforma Project Center

Default version status: unknown

  • 0 to < 2024.3affected
  • 2024.3unaffected

References