What is CVE-2025-35054?

CVE-2025-35054 is a medium-severity vulnerability in Newforma Project Center, classified under Storing Passwords in a Recoverable Format. CVSS score: 5.3/10. Published 2025-10-09.

How severe is CVE-2025-35054?

Medium severity. CVSS v3 base score is 5.3 out of 10.

Vulnerability in Newforma Project Center

CVE-2025-35054

Newforma Info Exchange (NIX) stores credentials used to configure NPCS in 'HKLM\Software\WOW6432Node\Newforma\<version>\Credentials'. The credentials are encrypted but the encryption key is stored in the same registry location. Authenticated users can access both the credentials and the encryption key. If these are Active Directory credentials, an attacker may be able to gain access to additional systems and resources.

EPSS: 0.001 (0.1th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 5.3 (Medium). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L.

Affected products

Newforma Project Center — versions 2024.3
Newforma Project_center

Weakness classification (CWE)

References

9119a7d8-5eab-497f-8521-727c672e3725 (Third Party Advisory)
9119a7d8-5eab-497f-8521-727c672e3725 (Third Party Advisory)

Frequently asked questions

What is CVE-2025-35054?: CVE-2025-35054 is a medium-severity vulnerability in Newforma Project Center, classified under Storing Passwords in a Recoverable Format. CVSS score: 5.3/10. Published 2025-10-09.
How severe is CVE-2025-35054?: Medium severity. CVSS v3 base score is 5.3 out of 10.