CVE-2025-35057 - CVE House
Back to Database
Status published Medium CVE-2025-35057

Newforma Info Exchange (NIX) forced NTLMv2 authentication via /RemoteWeb/IntegrationServices.ashx

Vulnerability Description

Newforma Info Exchange (NIX) '/RemoteWeb/IntegrationServices.ashx' allows a remote, unauthenticated attacker to cause NIX to make an SMB connection to an attacker-controlled system. The attacker can capture the NTLMv2 hash of the NIX service account.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-35057

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

  • Shadron Gudmunson,Luke Rindels,Robert McCain,Asjha Stus,Adam Merrill,Ryan Kao,Brian Healy, Sandia National Laboratories Adversarial Modeling and Penetration Testing (AMPT)

References

More from Newforma

View All →
CVE-2025-35062
Newforma Info Exchange (NIX) default anonymous access
Medium 6.9
CVE-2025-35061
Newforma Info Exchange (NIX) forced NTLMv2 authentication via /NPCSRemoteWeb/LegacyIntegrationServices.asmx
High 8.2
CVE-2025-35060
Newforma Info Exchange (NIX) stored XSS via SVG file upload
Medium 5.1
CVE-2025-35059
Newforma Info Exchange (NIX) open URL redirect via /DownloadWeb/hyperlinkredirect.aspx
Medium 5.3
CVE-2025-35058
Newforma Info Exchange (NIX) forced NTLMv2 authentication via /UserWeb/Common/MarkupServices.ashx
High 8.2

Affected Vendor

Affected Software

Project Center
Vulnerable Versions:
0, 2024.3

Timeline

Official Publish: October 9th, 2025
Last Modified: October 10th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

Weaknesses (CWE)

CWE-294

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.