Vulnerability

MIM Admin Service RMI interface lets a local attacker run code as the service

MedDevice Cyber Staff · Jun 4 · 2 min read · Via MIM Software advisory CVE-2025-1701

MIM Software disclosed CVE-2025-1701, a high-severity flaw in the MIM Admin service (CWE-20, CWE-306). A specially crafted request over its RMI interface executes arbitrary code with the service's privileges. Versions before 7.2.13, 7.3.8 and 7.4.3 are affected.

The RMI interface listens only on 127.0.0.1, so an attacker must already be on the machine running the service. MIM warns that this changes for sites exposing MIM through RDP or multi-user application virtualization, where the exposed system is the host running the virtualized client.

The fix is the 7.2.13, 7.3.8 or 7.4.3 patch release. As a stopgap, sites can block port 5981 on MIM client systems, which stops clients from starting and stopping MIM services; Fixed License customers must first switch to a Local or Concurrent license. On a shared virtualization host, every user session is local.

Are you a representative of MIM Software? Submit an official response →

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

Update the MIM Admin Service to 7.2.13, 7.3.8 or 7.4.3 or later to fix CVE-2025-1701. If an upgrade must wait, block port 5981 on MIM client systems; Fixed License customers need to switch to a Local or Concurrent license with MIM support first. Review who can log on to virtualization hosts running the MIM client.

Patch the Admin Service. Upgrade to 7.2.13+, 7.3.8+ or 7.4.3+ on every system running the MIM Admin Service.
Block port 5981 as a stopgap. Block connections to port 5981 on MIM clients, switching Fixed License sites to Local or Concurrent first.
Audit shared hosts. Limit and log interactive sessions on RDP or virtualization hosts that run the MIM client.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the signals and properties below. Check them against your product to gauge exposure. The named product rows list what the sources state about the affected product.

Contributing

Remote access

MIM Admin Service

Remote access

Fix the class in your product

A standard user on the workstation becomes SYSTEM, or the client hands over stored credentials. As the maker, load libraries only from fixed trusted paths, hold short-lived tokens instead of recoverable credentials, and remove user-writable directories from any privileged search path.

Pin library load paths. Restrict the search path and load by full absolute path, never from a working directory.
Hold tokens, not passwords. Keep a short-lived token in the OS vault; store nothing reusable at rest.
Set installer ACLs. No privileged binary loads from a location a standard user can write.

Mapped EMB3D mitigations

Questions & Answers

What is CVE-2025-1701 in the MIM Admin Service?

CVE-2025-1701 is a high-severity MIM Admin Service flaw where a crafted request to the local RMI interface runs arbitrary code with the service's privileges. Versions before 7.2.13, 7.3.8 and 7.4.3 are affected.

Can CVE-2025-1701 in MIM software be exploited remotely?

MIM Software says the RMI interface listens only on 127.0.0.1, so an attacker needs access to the machine running the MIM Admin Service. Systems exposed through RDP or application virtualization widen that access.

← Back to Vulnerabilities