CVE-2025-35062 is a medium severity flaw (CVSS 5.3) in Newforma Info Exchange (NIX), part of Newforma Project Center. Before version 2023.1, anonymous authentication is allowed by default, which lets an unauthenticated attacker reach features that other bugs need a login for. Upgrade to the latest version and follow the hardening guides.
What's affected
The record says NIX before version 2023.1 allows anonymous authentication by default. The CISA advisory VA-25-282-01 says anonymous access is no longer enabled by default as of 2023.1.
Note the word default. A newer install no longer starts with anonymous access on, but an older install that was upgraded may keep earlier settings. Check your actual configuration, not just the version number.
The same advisory lists many other Newforma issues, some serious. Its general recommendation is to follow updated hardening guides and upgrade to the most recent version of Newforma Project Center. For several of those issues it notes that no fix is available and offers network restrictions instead.
How to check if you're exposed
- Find your installed Newforma Info Exchange version in the product or installer details. Anything before 2023.1 is in scope.
- Check the web server authentication settings for NIX and see whether anonymous authentication is enabled.
- Check which NIX paths are reachable from the internet or from untrusted networks.
- Read the CISA advisory and the vendor hardening guide for your version.
You can also run the free in-browser dependency scan at gold.safeguard.sh/scan and browse the Gold directory for related advisories.
What to do now
- Upgrade Newforma Project Center and NIX to the most recent version available to you.
- Disable anonymous authentication where you do not need it.
- Keep NIX off the open internet where possible, or place it behind a reverse proxy or VPN.
- Apply the network restrictions the advisory suggests for the other listed issues.
- Review the other CVEs in the advisory so a single fix does not give a false sense of safety.
Why it matters
The weakness is CWE-276, incorrect default permissions. A product that starts open puts the burden on every administrator to close it. Many never do.
The impact here is indirect. Anonymous access does not by itself hand over data, but the record says it lets an unauthenticated attacker exploit additional vulnerabilities that require authentication. That turns a login gate into a speed bump. The CVE is not on the CISA Known Exploited Vulnerabilities list, and the record does not report exploitation.
Defaults deserve review at every upgrade. Treat them as part of your configuration baseline, not as a vendor promise.
Quick check
Is version 2023.1 enough?
It changes the default, according to the advisory. The advisory still recommends the most recent version and updated hardening guides, so go further than the minimum.
Does this fix the other Newforma issues?
No. The advisory lists a number of other CVEs with their own fixes or mitigations.
Sources
Last reviewed: 18 October 2026.
