Hard-coded credentials and client-side auth in nuclear-medicine software

MedDevice Cyber Staff · Dec 2 · 3 min read · Via CISA

Mirion Medical picked up ICSMA-25-336-01 for its EC2 nuclear-medicine software, the NMIS and BioDose products, versions before 23.0. Five high-severity CVEs. Hard-coded credentials, CVE-2025-64778. Client-side authentication, CVE-2025-61940 at 8.3, meaning the app trusts the browser to decide who is allowed in. Plus incorrect permission assignments up to 8.4.

Hard-coded credentials enter a codebase for ordinary reasons. A build needs a service account, an installer needs to reach a database, two components need to trust each other, and a fixed secret written into the software is the fastest way to make that work on the bench. The secret then ships to every customer identically, which turns a development convenience into a master key that anyone who reads the binary can copy.

Chained, they let an attacker modify executables, read sensitive data, gain unauthorized access and run arbitrary code. Joe Dillon reported it.

The setting sharpens the stakes. The software runs inside nuclear-medicine, a field where it supports the handling of radioactive material and the clinical work built around it. An attacker able to read sensitive data or run code on it sits against records clinicians rely on to be exactly what the instruments produced, and the integrity of those records is not a paperwork matter in that kind of department.

Client-side authentication is a product built as if the network were friendly. It never is. Auth decisions belong on the server, every time.

The fixed secret and the browser-side check describe the same underlying belief, that the software would only ever run on a trusted and quiet network. That belief is a legacy of an era when clinical instruments were islands. The advisory path, a coordinated identifier and a fixed release, is now the mechanism by which such an assumption gets corrected in public, product by product.

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

Mirion Medical EC2 software (NMIS, BioDose) carried five high-severity flaws including hard-coded credentials and authentication enforced only on the client (ICSMA-25-336-01). Apply the fix, and where auth was client-side, treat every control as reachable without it until the server enforces access.

Apply the vendor remediation. Install the fixed EC2 software versions named in ICSMA-25-336-01.
Move authorization to the server. Client-side checks are bypassable, so every privileged action must be re-authorized on the server.
Remove hard-coded credentials. Replace any embedded credential with per-deployment secrets that an operator sets and can rotate.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the properties below. Check them against your product to gauge exposure.

Contributing

app_user_accounts net_remote_access app_web_ui app_roles data_phi use_hospital_net sys_ots_software net_cloud

EMB3D

PID-332 PID-3321

Fix the class in your product

The shared secret ships in every unit, so one recovered credential is fleet-wide access. As the maker, delete embedded secrets from every artifact, provision a unique per-unit identity at manufacture, and force any default to be changed before the device is usable.

Provision a unique secret per unit. Derive it from a hardware-backed root so a dumped image unlocks nothing on another unit.
Remove credentials from shipped artifacts. Pull every secret out of the binary, installer, and app package; verify server-side against a slow hash.
Force default changes at setup. A device that runs on its shipped default should not become operational until the default is changed.

Mapped EMB3D mitigations

Questions & Answers

What was found in Mirion Medical EC2 software?

ICSMA-25-336-01 lists five high-severity flaws in the EC2 software line, including its NMIS and BioDose products. Two of the headline issues are hard-coded credentials and authentication enforced only on the client side.

Why is client-side authentication a problem?

If the check happens in the client, an attacker can skip the client and talk to the backend directly. The login gate becomes optional, which is why these rate high.

What is the remediation path?

Move to the fixed versions in the advisory, remove or rotate the built-in credentials where the vendor allows it, and keep the software off networks that untrusted users can reach until you have updated.

← Back to Vulnerabilities