CVE-2025-30051: Insecure File Permissions in CGM CLININET

Q: Who can exploit this issue?

Any local account that can read the SysIO.pl configuration file is exposed to the stored production database and RabbitMQ broker credentials. Exploitation requires local access to the affected CGM CLININET system.

Q: What should be done if an affected system cannot be updated immediately?

Restrict permissions on the SysIO.pl file so it is not readable by unprivileged local accounts. Because the file contains database and RabbitMQ credentials, consider rotating those credentials after correcting access.

Q: How can I determine whether a system is affected?

Check the installed CGM CLININET version and the permissions on SysIO.pl. The issue is fixed in version 2026.MS3; systems where any local account can read the file should be treated as affected.

Published Oct 23, 2026

Updated

The CGM CLININET application stores the production database login and password, as well as RabbitMQ broker credentials, in the SysIO.pl configuration file. Insecure file permissions make this file readable by any local account.

This issue was fixed in version 2026.MS3

Affected Software

1 affected component

CGM CLININET<2026.MS3

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade CGM CLININET to a version that resolves this vulnerability.
Fixed in 2026.MS3

Event History

Oct 23, 2026

CVE Published

via MITRE·08:22 AM

Data Sourced

via MITRE·08:22 AM

DescriptionWeakness

Frequently Asked Questions

Who can exploit this issue?

Any local account that can read the SysIO.pl configuration file is exposed to the stored production database and RabbitMQ broker credentials. Exploitation requires local access to the affected CGM CLININET system.

What should be done if an affected system cannot be updated immediately?

Restrict permissions on the SysIO.pl file so it is not readable by unprivileged local accounts. Because the file contains database and RabbitMQ credentials, consider rotating those credentials after correcting access.

How can I determine whether a system is affected?

Check the installed CGM CLININET version and the permissions on SysIO.pl. The issue is fixed in version 2026.MS3; systems where any local account can read the file should be treated as affected.

CVE-2025-30051: Insecure File Permissions in CGM CLININET

Affected Software

Remediation

Event History

Frequently Asked Questions

Who can exploit this issue?

What should be done if an affected system cannot be updated immediately?

How can I determine whether a system is affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What should be done if an affected system cannot be updated immediately?

How can I determine whether a system is affected?