CVE-2025-1701

CVE-2025-1701 is a high-severity vulnerability in the MIM Admin service. An attacker could exploit this vulnerability by sending a specially crafted request over the RMI interface to execute arbitrary code with the privileges of the MIM Admin service. The RMI interface is only accessible locally (listening on 127.0.0.1), limiting the attack vector to the local machine. This means that in a properly configured hospital environment, an attacker must have already compromised the network and additionally compromised the system where the MIM Admin service is running. From there, attackers with sufficient knowledge of MIM's implementation, library usage, and functionality with access to extend the MIM RMI library could force the MIM Admin service to run commands on the local machine with its privileges. Users of MIM Software products exposed via RDP or multi-user application virtualization system should take note that the system being exposed is the environment hosting the virtualized MIM client. This issue affects MIM Admin Service: before 7.2.13, 7.3.8, 7.4.3

• CWE-20
• CWE-306

• https://www.mimsoftware.com/cve-2025-1701

Published

Jun 4, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-1695In NGINX Unit before version 1.34.2 with the Java Language M…5.3
• CVE-2025-1696A vulnerability exists in Docker Desktop prior to version 4.…5.2
• CVE-2025-1697A potential security vulnerability has been identified in th…7.8
• CVE-2025-1698Null pointer exception vulnerabilities were reported in the …2.8
• CVE-2025-1699An incorrect default permissions vulnerability was reported …2.8
• CVE-2025-1700A DLL hijacking vulnerability was reported in the Motorola S…7.1
• CVE-2025-1702The Ultimate Member – User Profile, Registration, Login, Mem…7.5
• CVE-2025-1703The Ultimate Blocks plugin for WordPress is vulnerable to St…6.4
• CVE-2025-1704ComponentInstaller Modification in ComponentInstaller in Goo…6.5
• CVE-2025-1705The tagDiv Composer plugin for WordPress is vulnerable to Cr…6.1
• CVE-2025-1706Software installed and run as a non-privileged user may cond…7.5
• CVE-2025-1707The Review Schema plugin for WordPress is vulnerable to Loca…8.8