CVE-2025-30043: Missing Authentication in CGM CLININET

Q: Who can exploit this issue?

An unauthenticated attacker with access to the adjacent network can access the affected endpoint. The issue exposes patient-document listings and allows document downloads.

Q: Which versions are affected or fixed?

The issue was fixed in CGM CLININET version 2026.MS3. The provided information does not identify the first affected version or a complete affected-version range.

Q: What can be done if updating is not immediately possible?

Limit adjacent-network access to the CGM CLININET service to trusted systems only, since exploitation requires adjacent-network reachability and does not require authentication.

Published Oct 23, 2026

Updated

CGM CLININET is vulnerable to Missing Authentication for Critical Function in the /DocManagment path. The endpoint is accessible without authentication, allowing an unauthenticated attacker in the adjacent network to retrieve the list of patient documents and download those documents.

This issue was fixed in version 2026.MS3

Affected Software

1 affected component

CGM CLININET<2026.MS3

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade CGM CLININET to a version that resolves this vulnerability.
Fixed in 2026.MS3

Event History

Oct 23, 2026

CVE Published

via MITRE·08:22 AM

Data Sourced

via MITRE·08:22 AM

DescriptionWeakness

Frequently Asked Questions

Who can exploit this issue?

An unauthenticated attacker with access to the adjacent network can access the affected endpoint. The issue exposes patient-document listings and allows document downloads.

Which versions are affected or fixed?

The issue was fixed in CGM CLININET version 2026.MS3. The provided information does not identify the first affected version or a complete affected-version range.

What can be done if updating is not immediately possible?

Limit adjacent-network access to the CGM CLININET service to trusted systems only, since exploitation requires adjacent-network reachability and does not require authentication.

CVE-2025-30043: Missing Authentication in CGM CLININET

Affected Software

Remediation

Event History

Frequently Asked Questions

Who can exploit this issue?

Which versions are affected or fixed?

What can be done if updating is not immediately possible?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

Which versions are affected or fixed?

What can be done if updating is not immediately possible?