CVE-2025-30053: Missing Authentication in CGM CLININET

Q: Who is exposed to this issue?

CGM CLININET deployments running versions up to 2026.MS3 are confirmed affected. Later versions may also be affected, but this is not confirmed by the available information.

Q: What access does an attacker need to exploit it?

An attacker needs network access to the open port on which the cgm-updater process is listening. The process does not require authentication on that port.

Q: Are default deployments affected?

The available information confirms that cgm-updater listens on an open network port without authentication, but it does not state whether this behavior requires a configuration change or occurs in a default deployment.

Published Oct 23, 2026

Updated

The CGM CLININET application runs the cgm-updater process listening on an open network port without any authentication.

The vulnerability was confirmed to affect versions up to 2026.MS3 but later versions may also be vulnerable.

Affected Software

1 affected component

CGM CLININET<=2026.MS3

Event History

Oct 23, 2026

CVE Published

via MITRE·08:22 AM

Data Sourced

via MITRE·08:22 AM

DescriptionWeakness

Frequently Asked Questions

Who is exposed to this issue?

CGM CLININET deployments running versions up to 2026.MS3 are confirmed affected. Later versions may also be affected, but this is not confirmed by the available information.

What access does an attacker need to exploit it?

An attacker needs network access to the open port on which the cgm-updater process is listening. The process does not require authentication on that port.

Are default deployments affected?

The available information confirms that cgm-updater listens on an open network port without authentication, but it does not state whether this behavior requires a configuration change or occurs in a default deployment.

CVE-2025-30053: Missing Authentication in CGM CLININET

Affected Software

Event History

Frequently Asked Questions

Who is exposed to this issue?

What access does an attacker need to exploit it?

Are default deployments affected?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What access does an attacker need to exploit it?

Are default deployments affected?