CVE-2025-30043

HighCVSS 7.1/10Last modified Oct 23, 2026

Description

CGM CLININET is vulnerable to Missing Authentication for Critical Function in the /DocManagment path. The endpoint is accessible without authentication, allowing an unauthenticated attacker in the adjacent network to retrieve the list of patient documents and download those documents.

This issue was fixed in version 2026.MS3

Metrics

CVSS 4.0 7.1/10

CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-306

Affected software

No affected versions have been published.

Timeline

Published: Oct 23, 2026
Last modified: Oct 23, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-300449.4In the endpoints "/cgi-bin/CliniNET.prd/utils/usrlogstat_simple.pl", "/cgi-bin/CliniNET.prd/utils/usrlogstat.pl", "/cgi-bin/CliniNET.prd/uti CVE-2025-300458.6CGM CLININET is vulnerable to Code Injection in the ConvExpr function, which processes Perl expressions into RTF document content. Due to im CVE-2025-300469.0In the CGM CLININET application server, multiple processes responsible for HL7 communication with external systems run with root privileges CVE-2025-300479.4CGM CLININET is vulnerable to Remote Code Execution caused by deserialization of untrusted data. The server exposes an HTTP-based API, used CVE-2025-300485.3The "serverConfig" endpoint, which returns the module configuration including credentials, is accessible without authentication.CVE-2025-300498.2The CGM CLININET application stores user passwords as unsalted MD5 hashes. This issue was fixed in versions 2026.MS1 and 2026.MS3 CVE-2025-30055.4A vulnerability was found in Sayski ForestBlog up to 20250321 and classified as problematic. Affected by this issue is some unknown function CVE-2025-300509.4CGM CLININET is vulnerable to Code Injection in the RunCGI.pm component, which dynamically imports the module specified as a query parameter CVE-2025-300516.8The CGM CLININET application stores the production database login and password, as well as RabbitMQ broker credentials, in the SysIO.pl conf CVE-2025-300528.8The rsyncd service of the CGM CLININET is vulnerable to Authentication Bypass via IP spoofing. Access is granted based solely on the client'CVE-2025-300536.9The CGM CLININET application runs the cgm-updater process listening on an open network port without any authentication. The vulnerabilit CVE-2025-300549.3CGM CLININET is vulnerable to local privilege escalation. The service that processes incoming HL7 messages runs with root privileges, but du