CVE-2025-35061
Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.
NVD · uneditedNewforma Info Exchange (NIX) '/NPCSRemoteWeb/LegacyIntegrationServices.asmx' allows a remote, unauthenticated attacker to cause NIX to make an SMB connection to an attacker-controlled system. The attacker can capture the NTLMv2 hash of the user-configured NIX service account.
Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.
dbcve analysis · high confidenceThe LegacyIntegrationServices.asmx endpoint in Newforma Info Exchange (NIX) is vulnerable to NTLM relay attacks. An unauthenticated remote attacker can trigger the NIX service to initiate an SMB connection to an attacker-controlled server, allowing capture of the NTLMv2 hash of the NIX service account. This is a classic SMB/NTLM relay vulnerability where the application's lack of proper SMB connection validation enables credential harvesting.
Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.
Affected products & versions What the vendor confirmedThe version ranges the vendor confirmed as vulnerable. If your version sits inside a range here, treat yourself as exposed until you have upgraded.
NVD · CPE data< 2023.2CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.
From the vector- Attack vector
- Network
- Complexity
- High
- Privileges
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- None
- Availability
- None
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.
dbcve checksWork through these to decide whether this CVE applies to you.
-
Identify Newforma Project Center versionCheck the installed version of Newforma Project Center in Windows Programs and Features or by querying the application executable version. Compare against the affected range: versions prior to 2023.2 are vulnerable.Affected if Installed version is Newforma Project Center and is earlier than version 2023.2
-
Verify LegacyIntegrationServices.asmx existsCheck if the file LegacyIntegrationServices.asmx exists in the NIX web services directory. The default path is typically under the NIX installation folder, but verify its presence on the server.Affected if The LegacyIntegrationServices.asmx endpoint is present on the server in an accessible web directory
-
Confirm NTLM authentication is enabledReview the NIX service or IIS configuration to determine whether NTLM authentication is permitted for the web service endpoint. Check authentication settings in the web.config file or IIS authentication modules.Affected if NTLM authentication is enabled or allowed for the LegacyIntegrationServices.asmx endpoint
-
Check NIX service account configurationIdentify the service account running the NIX (Newforma Info Exchange) service. Determine if it has privileges that would make its NTLMv2 hash valuable to an attacker.Affected if The NIX service runs under a domain or privileged account rather than a low-privilege service account
-
Inspect outbound SMB connectivity restrictionsReview host-based firewall rules or network filtering to determine if the NIX server is permitted to initiate outbound SMB connections (ports 445/139) to arbitrary destinations.Affected if No firewall or network segmentation is in place to restrict outbound SMB traffic from the NIX server
The environment is affected if Newforma Project Center version is earlier than 2023.2, the LegacyIntegrationServices.asmx endpoint exists, NTLM authentication is enabled, and outbound SMB connections are not restricted.
Generated from the published advisory. Verify against your own configuration.
Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.
dbcve · scoped2023.2
Restrict outbound SMB traffic (ports 445/139) from the NIX server to untrusted networks using host-based firewalls or network segmentation. Apply vendor-supplied patches when available and consider disabling NTLM authentication in favor of Kerberos with SMB signing enabled.
Project Center 2023.2 or later
- 1. Verify current Project Center version by checking the application's 'About' or version information
- 2. Download Project Center version 2023.2 or later from the official Newforma distribution source
- 3. Create a full backup of the current Project Center database and configuration files
- 4. Test the upgrade in a non-production environment before deploying to production
- 5. Apply the upgrade following Newforma's standard installation documentation
- 6. Verify the '/NPCSRemoteWeb/LegacyIntegrationServices.asmx' endpoint is properly secured after upgrade
- 7. Confirm the NIX service account can authenticate correctly post-upgrade
Generated from the published advisory — verify against the referenced sources before acting.
- Consultation4.0 h
- Implementation8.0 h
- Testing6.0 h
- Review / QA4.0 h
An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $6,176.
Scan for this in your stack
Free · runs locallyCheck whether your project pulls in CVE-2025-35061 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.
References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.
Primary sourcesPractitioner notes
ContributedPeer-ranked notes from engineers who’ve handled CVE-2025-35061 in production — separate from our analysis above.
The advisory tells you what broke. It rarely tells you what actually worked. If you’ve dealt with this one, that detail is what the next engineer is searching for.
- The version that genuinely resolved it — not the one the vendor claimed
- A config change or rule that shut the vector down
- A gotcha in the upgrade path that cost you an afternoon
No notes yet
Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.
A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.
- Verified mitigations, workarounds, and config changes
- Version or environment caveats, and links to real fixes
- No weaponised exploit code, or anything meant to cause harm
- No spam, self-promotion, credentials, or personal data