CVE-2025-14095
Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.
NVD · uneditedA "Privilege boundary violation" vulnerability is identified affecting multiple Radiometer Products. Exploitation of this vulnerability gives a user with physical access to the analyzer, the possibility to gain unauthorized access to functionalities outside the restricted environment. The vulnerability is due to weakness in the design of access control implementation in application software. Other related CVE's are CVE-2025-14096 & CVE-2025-14097. Affected customers have been informed about this vulnerability. This CVE is being published to provide transparency. Required configuration for Exposure: Physical access to the analyzer is needed. Temporary work Around: Only authorized people can physically access the analyzer. Permanent solution: Local Radiometer representatives will contact all affected customers to discuss a permanent solution. Exploit Status: Researchers have provided working proof-of-concept. Radiometer is not aware of any publicly available exploit at the time of publication. Note: CVSS score 6.8 when underlying OS is Windows 7 or Windows XP Operating systems and CVSS score 5.7 when underlying OS is Windows 8 or Windows 10 operating systems.
Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.
dbcve analysis · moderate confidenceThis is a privilege boundary violation in Radiometer medical diagnostic analyzers where physical access allows users to bypass designed access controls and reach functionalities outside a restricted environment. The vulnerability stems from weaknesses in the access control design implementation in the application software. The CVSS varies based on underlying OS (6.8 for Windows 7/XP, 5.7 for Windows 8/10).
Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.
CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.
From the vector- Attack vector
- Physical
- Complexity
- Low
- Privileges
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- High
- Availability
- High
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.
dbcve checksWork through these to decide whether this CVE applies to you.
-
Identify the Radiometer analyzer model and software versionLocate the analyzer unit nameplate or system information screen to record the exact model number and installed software version. Compare against any Radiometer documentation or release notes for your specific analyzer type.Affected if The analyzer is a Radiometer medical diagnostic device running application software without the vendor patch.
-
Determine the host operating system versionAccess the analyzer's underlying operating system (typically accessed via service mode or system information) to identify if it runs Windows 7, Windows XP, Windows 8, or Windows 10.Affected if The OS is Windows 7 or Windows XP (CVSS 6.8) rather than Windows 8/10 (CVSS 5.7), indicating higher severity.
-
Assess physical access controls to the analyzerInspect the physical location of the analyzer unit. Determine whether the device is in a secured area with controlled access, or in a publicly accessible or minimally supervised location.Affected if Physical access to the analyzer is not restricted to authorized personnel only, allowing unauthorized individuals to reach the device.
-
Verify restricted environment access controlsAttempt to access functionalities outside the restricted environment (e.g., admin functions, system settings, or elevated operations) from a standard user session to confirm whether access controls are enforced.Affected if A user with physical access can bypass designed access restrictions and reach functionalities intended to be limited to the restricted environment.
-
Check for vendor patch statusContact Radiometer service representatives or check available service bulletins to confirm whether the vendor patch for CVE-2025-14095 has been applied to your system.Affected if The vendor patch has not been applied and the device remains unpatched.
A user is affected if they have a Radiometer analyzer device where physical access is not strictly controlled and the vendor patch has not been applied, allowing bypass of access controls to reach restricted functionalities.
Generated from the published advisory. Verify against your own configuration.
Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.
From vendor dataImplement strict physical access controls to the analyzer hardware. Await and apply the permanent vendor patch from Radiometer representatives, as this requires specialized medical device firmware/software updates that cannot be self-applied.
- Consultation4.0 h
- Implementation6.0 h
- Testing8.0 h
- Review / QA4.0 h
An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $6,080.
Scan for this in your stack
Free · runs locallyCheck whether your project pulls in CVE-2025-14095 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.
References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.
Primary sourcesPractitioner notes
ContributedPeer-ranked notes from engineers who’ve handled CVE-2025-14095 in production — separate from our analysis above.
The advisory tells you what broke. It rarely tells you what actually worked. If you’ve dealt with this one, that detail is what the next engineer is searching for.
- The version that genuinely resolved it — not the one the vendor claimed
- A config change or rule that shut the vector down
- A gotcha in the upgrade path that cost you an afternoon
No notes yet
Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.
A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.
- Verified mitigations, workarounds, and config changes
- Version or environment caveats, and links to real fixes
- No weaponised exploit code, or anything meant to cause harm
- No spam, self-promotion, credentials, or personal data