关键漏洞信息 CVE ID: CVE-2025-35054 发布日期: 2025-10-09 更新日期: 2025-10-09 标题: Newforma Info Exchange (NIX) Insufficiently Protected Credentials 描述: Newforma Info Exchange (NIX) 存储用于配置NPCS的凭据在 'HKLMSoftware/WOW6432Node/Newforma/version/Credentials'。凭据是加密的，但加密密钥存储在同一注册表位置。经过身份验证的用户可以访问凭据和加密密钥。如果这些是Active Directory凭据，攻击者可能能够访问其他系统和资源。 CWE: - CWE-922: Insecure Storage of Sensitive Information - CWE-522: Insufficiently Protected Credentials - CWE-257: Storing Passwords in a Recoverable Format CVSS: - Score: 5.3 ( Severity: MEDIUM, Version: 3.1 ) - Score: 4.8 ( Severity: MEDIUM, Version: 4.0 ) 受影响产品: - Vendor: Newforma - Product: Project Center - Versions: Affected all 参考链接**: - raw.githubusercontent.com: url - cve.org: url