Vulnerability · Published Oct 9, 2025 · Assigned by cisa-cg

CVE-2025-35054Newforma Info Exchange (NIX) insufficiently protected credentials

Medium 5.3

In plain English

A medium-severity security flaw in Project Center from Newforma. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 0% of all known vulnerabilities).

Severity (CVSS 3.1)5.3Medium

Exploit odds (30 days)<0.1%top 99.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Newforma Info Exchange (NIX) stores credentials used to configure NPCS in 'HKLM\Software\WOW6432Node\Newforma\<version>\Credentials'. The credentials are encrypted but the encryption key is stored in the same registry location. Authenticated users can access both the credentials and the encryption key. If these are Active Directory credentials, an attacker may be able to gain access to additional systems and resources.

Affected products (as reported)

Vendor	Product	Versions
Newforma	Project Center	*2024.3

Weakness: CWE-922, CWE-522, CWE-257 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

In plain English

Official description

Affected products (as reported)

References