Remote Code Execution Vulnerability in Newforma Info Exchange
CVE-2025-35058

8.2HIGH

Key Information:

Vendor

Newforma

Status
Project Center
Vendor
CVE Published:
9 October 2025

What is CVE-2025-35058?

A vulnerability in Newforma Info Exchange allows unauthenticated remote attackers to exploit a flaw in the MarkupServices.ashx endpoint. By manipulating requests, an attacker can trigger the NIX application to initiate an SMB connection to their malicious system, enabling them to capture NTLMv2 hashes associated with the user's service account. This poses a significant risk to the confidentiality and integrity of sensitive information managed by the NIX platform.

Affected Version(s)

Project Center 0 < 2023.2

Project Center 2023.2

References

https://raw.githubusercontent.com/cisagov/CSAF/develop/cs...
https://www.cve.org/CVERecord?id=CVE-2025-35058

CVSS V4

Score:
8.2
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Shadron Gudmunson,Luke Rindels,Robert McCain,Asjha Stus,Adam Merrill,Ryan Kao,Brian Healy, Sandia National Laboratories Adversarial Modeling and Penetration Testing (AMPT)
JSON
.