dbcve.org
CWE-250Weakness · CWE-250

CVE-2025-14096

HIGH · 8.4 CVSS v3.1 Published 2025-12-17
Mitigation only
No fix yet — a mitigation exists. There is no fixed release. A documented workaround reduces exposure in the meantime.
See remediation →
89/100
Remediation priority · High
No privileges Zero-click

Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.

NVD · unedited
A vulnerability exists in multiple Radiometer products that allow an attacker with physical access to the analyzer possibility to extract credential information. The vulnerability is due to a weakness in the design and insufficient credential protection in operating system. Other related CVE's are CVE-2025-14095 & CVE-2025-14097. Affected customers have been informed about this vulnerability. This CVE is being published to provide transparency. Required Configuration for Exposure: Attacker requires physical access to the analyzer. Temporary work Around: Only authorized people can physically access the analyzer. Permanent solution: Local Radiometer representatives will contact all affected customers to discuss a permanent solution. Exploit Status: Researchers have provided a working proof-of-concept (PoC). Radiometer is not aware of any public exploit code at the time of this publication.

Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.

dbcve analysis · moderate confidence

This is a physical security vulnerability in Radiometer medical analyzers where an attacker with physical access can extract credential information due to insufficient credential protection in the operating system. The weakness stems from design flaws rather than a simple implementation bug, meaning credentials are not adequately encrypted, hashed, or otherwise protected at rest or in memory.

MitigationPhysical access control is the primary workaround - restrict unauthorized access to analyzers. The permanent fix requires vendor-supplied patches or firmware updates that implement proper credential protection mechanisms in the operating system.

Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.

CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.

From the vector
Attack vector
Local
Complexity
Low
Privileges
None
User interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.

dbcve checks

Work through these to decide whether this CVE applies to you.

  1. Identify the Radiometer medical analyzer model
    Locate the device label or system information that displays the analyzer make, model, and firmware/software version. Compare this against any Radiometer product documentation or release notes you can obtain.
    Affected if The device is a Radiometer medical analyzer and the installed version is unknown, older, or predates vendor credential protection updates.
  2. Review credential storage locations
    Examine the file system for stored credential files, configuration files containing passwords or authentication tokens, or database files holding user credentials. Look in common system directories and application data folders where such information might be persisted.
    Affected if Credential files exist in plaintext, weakly encrypted, or unencrypted formats on the device storage.
  3. Check OS-level file protection mechanisms
    Inspect file permissions on credential storage locations. Verify whether sensitive authentication data is protected by operating system access controls that prevent unauthorized reading.
    Affected if Credential files have overly permissive access rights (e.g., world-readable) or lack OS-enforced protection against unauthorized access.
  4. Assess physical access controls
    Evaluate whether the analyzer is located in an area with controlled physical access. Verify that only authorized personnel can physically reach the device, connect removable media, or interact with console ports.
    Affected if The analyzer is in an area accessible to unauthorized individuals, enabling physical access exploitation of the credential protection weakness.

You are affected if your environment contains a Radiometer medical analyzer where stored credentials lack adequate OS-level or cryptographic protection and the device is accessible to individuals without proper authorization.

Generated from the published advisory. Verify against your own configuration.

Check your environment

Paste your version and any relevant configuration and it will be compared against the affected criteria above. Do not include secrets or credentials.

AI-assisted, checked against the advisory. Informational, not a guarantee.

Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.

From vendor data
Mitigation available No clean upgrade yet — mitigate in the meantime
Mitigation

Physical access control is the primary workaround - restrict unauthorized access to analyzers. The permanent fix requires vendor-supplied patches or firmware updates that implement proper credential protection mechanisms in the operating system.

Have this fixed Scoped from the published advisory
  • Consultation12.0 h
  • Implementation32.0 h
  • Testing24.0 h
  • Review / QA12.0 h
80.0 hours of engineering $13,920
Get help mitigating

An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $22,272.

Scan for this in your stack

Free · runs locally
dbcve dependency scanner

Check whether your project pulls in CVE-2025-14096 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.

Get it on GitHub Scan in the browser

References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.

Primary sources

Practitioner notes

Contributed

Peer-ranked notes from engineers who’ve handled CVE-2025-14096 in production — separate from our analysis above.

No notes yet

Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.

What this is

A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.

What belongs here
  • Verified mitigations, workarounds, and config changes
  • Version or environment caveats, and links to real fixes
  • No weaponised exploit code, or anything meant to cause harm
  • No spam, self-promotion, credentials, or personal data