CGM CLININET CVE-2025-30051

Exploitation requires the attacker to already possess a local account (any privilege level) on the host running CGM CLININET, because the SysIO.pl configuration file is readable by any local account due to insecure file permissions. The concrete prerequisite is local presence on the CLININET application server; no authentication to the application itself and no user interaction are needed. Limiting factors: there is no remote vector (AV:L) - the flaw cannot be triggered over the network - so it depends on a prior local foothold or a legitimate shared/multi-user host, and its value is realized only when the leaked production database and RabbitMQ credentials can reach their respective services. The complete fix is upgrading to version 2026.MS3 as stated by the vendor; no other mitigation is described in the available sources.

This is a credential-disclosure flaw (CWE-732, insecure file permissions) rated CVSS 4.0 6.8 (Medium) by the vendor/CERT-PL. The provided CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N) is internally consistent with the description: exploitation is local (AV:L), requires an existing low-privilege local account (PR:L), needs no special conditions or user interaction (AC:L/AT:N/UI:N), and yields high confidentiality impact with no integrity or availability impact (VC:H/VI:N/VA:N). No EPSS score, no CISA KEV listing, and no public exploit were supplied in the input, so there is no public exploit identified at time of analysis and no quantitative exploitation-probability signal to compare against. The vuln.today decision label is 'this_month' (not act_now/emergency), consistent with a locally-exploitable medium-severity issue rather than a remotely-wormable one. The real risk is secondary and situational: the flaw does not grant initial access by itself, but once any local account exists on the CLININET host, it hands over production database and RabbitMQ broker credentials, enabling lateral movement and privilege escalation into the backend data tier of a hospital information system. Prioritize it as a this-month patch where the product is deployed, especially on multi-user or shared hosts; it is not a low-real-risk 'high-CVSS' false alarm, but it is also not a drop-everything remote emergency.

A low-privileged local user - or an attacker who has already gained a foothold on the CLININET server through any other means - reads the world-readable SysIO.pl configuration file and extracts the plaintext production database credentials and RabbitMQ broker credentials. Using those credentials they connect directly to the clinical database and message broker, bypassing the application's access controls to read or manipulate patient and operational data. No public exploit code is required; reading a file is sufficient.