CGM CLININET CVE-2025-30052

Requires that the CGM CLININET rsyncd daemon be network-reachable and configured to authorize clients solely by source IP address (host-based allow list) with no secrets/password authentication. The attacker must know or discover an allowed IP and must be able to spoof it against a TCP service - i.e. hold an on-path position or otherwise inject packets that survive the TCP handshake, which bounds realistic attacks to adversaries with network positioning rather than arbitrary internet hosts. Confirmed affected through version 2026.MS3, with later versions possibly affected; no special user interaction or prior authentication is needed once an allowed IP can be spoofed.

Signals are mixed and some are absent. The CVSS 4.0 base vector (AV:N/AC:L/AT:N/PR:N/UI:N) rates this network-reachable, low-complexity and unauthenticated, with high integrity impact (VI:H) and high availability impact (VA:H) on the vulnerable system, yielding 8.8 - genuinely severe on paper. However, the mechanism (CWE-290 authentication bypass via source-IP spoofing of a TCP-based rsyncd service) materially qualifies that 'low complexity' rating: blind spoofing of an allowed source IP across a TCP three-way handshake requires on-path positioning or sequence-number prediction, which in practice raises real-world attack complexity above what AC:L/AT:N implies - verify the network exposure before treating this as trivially remote. No EPSS score, no CISA KEV listing, and no SSVC exploitation/automatable values were supplied, and no PoC or exploit reference is present, so there is no evidence of active or automated exploitation. The vuln.today decision label is 'this_week' (not act_now/emergency), consistent with a serious-but-not-actively-exploited finding. Net: a high-severity integrity/availability flaw in a healthcare product that warrants prompt remediation this week, but there is no current signal of mass or automated exploitation, and the IP-spoofing precondition likely confines realistic attacks to adversaries with network positioning.

An attacker with the ability to inject spoofed TCP traffic (on-path or within the hospital network) identifies a source IP that the CLININET rsyncd daemon trusts, impersonates that address to satisfy the source-IP access check, and thereby gains unauthorized write access to edit files on the affected system. No public exploit identified at time of analysis; because rsyncd runs over TCP, realistic exploitation requires on-path interception or packet-injection capability rather than a simple remote request.