CGM CLININET CVE-2025-30049

The attacker must first obtain the stored password values from CGM CLININET - for example via database access, an exposed or stolen backup, SQL injection, or insider/privileged access; this prerequisite is what the CVSS 4.0 AT:P flag reflects. Given the hashes, the unsalted MD5 scheme (CWE-916) permits fast offline recovery of plaintext passwords through rainbow tables or brute force because identical passwords produce identical hashes and no per-user salt or computational cost impedes cracking. Limiting factors: the flaw is passive and does not itself grant any access or expose the hashes - it only weakens credential protection once a hash store is already compromised, and impact is confined to confidentiality of credentials (no integrity or availability effect). The available sources do not state how an attacker would obtain the hash store.

The input assigns a high CVSS 4.0 base score of 8.2 driven by VC:H (full disclosure of user passwords) with AV:N/AC:L/PR:N/UI:N, but the AT:P flag (Attack Requirements: Present) is the decisive signal: exploitation is not self-contained. CWE-916 (use of a password hash with insufficient computational effort) describes a data-at-rest weakness - unsalted MD5 hashes are only valuable to an attacker who has already obtained the hash store, so this flaw amplifies the impact of a separate breach rather than granting initial access on its own. The vuln.today decision label is 'this_week', indicating moderate rather than emergency urgency. No EPSS score, no CISA KEV listing, and no PoC or exploit reference are present in the input, so exploitation probability signals are absent rather than low - EPSS being missing is not evidence of safety. Net: the raw 8.2 overstates standalone remote risk because the AT:P precondition (prior access to the credential store) gates real-world exploitation; this is a genuine credential-protection defect to remediate on a normal patch cadence, not an internet-facing drive-by. The trigger - how an attacker obtains the hashes - is not described in the available sources.

An attacker who gains read access to the CGM CLININET credential store (for example through a database compromise, exposed backup, or insider access) extracts the stored password values. Because the passwords are hashed with unsalted MD5, the attacker cracks them offline at high speed using precomputed rainbow tables or GPU brute force, recovering plaintext credentials that can be reused to log in. No public exploit identified at time of analysis; the weakness is passive and requires the hash material to already be in the attacker's possession.