EUVD-2025-211183
GHSA-r5px-2ffh-84g7
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach exposed cgm-updater network port
-
ExploitConnect without any authentication
-
ExecutionInteract with unauthenticated updater service
-
ImpactLimited disclosure or tampering of data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication required for critical functions
MITRE ATT&CK
1 technique across 1 tactic: Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The cgm-updater process listens on an open network port with no authentication, so any attacker able to reach that port can interact with the service against what the description presents as the running configuration - no special feature toggle or non-default mode is stated as required. Limiting factors: the attacker must have network reachability to the specific cgm-updater port (plausibly confined to an internal hospital network rather than the public internet), and the impact is bounded to LOW confidentiality, integrity, and availability per the CVSS vector. The exact protocol handled on the port and the precise action an attacker performs are not described in the available sources. |
| Impact | This is a missing-authentication flaw (CWE-306): the cgm-updater process of CGM CLININET listens on an open network port with no authentication. The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L) scores 6.9 (Medium) - network-reachable, low-complexity, no privileges or user interaction, but all three impacts rated LOW, so this is exposure/limited-tampering rather than full system takeover. The vuln.today Decision label is 'this_month' (not act_now/emergency), which aligns with the Medium severity. No EPSS score, no CISA KEV listing, and no PoC/exploit reference are present in the input - the two references are the CERT-PL advisory and the vendor product page, so there is no public exploit identified at time of analysis. Signals are internally consistent: unauthenticated network access (easy to reach) tempered by low technical impact. Note one data conflict: the CVE ID is CVE-2025-30053 but the CERT-PL reference URL points to CVE-2025-30043 - verify which advisory actually describes this issue. Overall this is a genuine but moderate-priority exposure, not a drop-everything emergency. |
| Exploit ScenarioDerived | An attacker with network reachability to the host running CGM CLININET connects to the open cgm-updater port and interacts with the service without providing any credentials, since no authentication is enforced. Because the CVSS impacts are all LOW, the realistic outcome is limited information disclosure or limited tampering rather than full compromise. No public exploit code was identified in the provided references. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 23, 2026
The cgm-updater process shipped with CGM CLININET exposes a network listener that performs no authentication, so anything that can reach that port can interact with the updater service directly. The behaviour is confirmed in versions up to 2026.MS3, and the vendor material does not rule out later builds. Impact is bounded - confidentiality, integrity and availability are all rated Low in the assessed vector - and no public exploit code has been identified at time of analysis; the practical exposure depends on whether the updater port is reachable from untrusted network segments, which in hospital deployments is typically an internal-network question rather than an internet-facing one.
RemediationAI
No vendor-released patch identified at time of analysis: the supplied references consist of the CERT Polska advisory and the CGM product page, neither of which provides a fixed version number, so confirm the remediation release directly with CGM before planning an upgrade. Because the service is unauthenticated by design in affected builds, the actionable interim control is network-level: restrict reachability to the cgm-updater port with host or segment firewall rules so that only the management or update hosts that genuinely need it can connect. The trade-off is that any remote or distributed update workflow relying on broader access will stop working until rules are adjusted, so inventory updater clients first. Where the updater is not actively used, block the port outright rather than allow-list it. Pair these rules with logging on the blocked and permitted paths so attempted unauthenticated connections are visible; the missing authentication cannot be compensated for at the application layer without vendor changes.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CWE-306 (Missing Authentication for Critical Function) describes the root cause precisely: the cgm-updater component of CGM CLININET binds a network port and accepts requests without any credential check, so the service itself is the only barrier between a network peer and updater functionality. CPE data (cpe:2.3:a:cgm:cgm_clininet) confirms the affected package is the CLININET hospital application rather than an underlying OS or third-party library component. The CVSS:4.0/3.1 vectors both score it AV:N/AC:L/PR:N/UI:N, meaning the flaw is reachable over the network with no privileges and no user interaction; the trigger is simply reaching the listening port, and no special feature toggle or non-default deployment mode is stated as a prerequisite. What is not established by the available sources is the protocol carried on that port, whether any request validation exists downstream of the missing authentication, and the specific action an attacker would take once connected - those details are absent from both the CVE description and the CERT Polska advisory reference.
Know when Cgm Clininet gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
An unauthenticated service on an open network port gives AV:N/AC:L/PR:N/UI:N; impacts kept LOW (C:L/I:L/A:L) and S:U to match the supplied limited-impact assessment.
Primary rating from Vendor (CERT-PL).
CVSS VectorVendor: CERT-PL
DescriptionCVE.org
The CGM CLININET application runs the cgm-updater process listening on an open network port without any authentication.
The vulnerability was confirmed to affect versions up to 2026.MS3 but later versions may also be vulnerable.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Cgm Clininet
View allRemote code execution in CGM CLININET lets unauthenticated attackers on the same local network execute arbitrary code as
Code injection in the RunCGI.pm component of CGM CLININET allows an attacker positioned on an adjacent network segment t
Local privilege escalation in CGM CLININET allows anyone who already holds the low-privileged uhcapache account to rewri
Remote code execution with root privileges affects CGM CLININET application servers through version 2026.MS3, where HL7
Authentication bypass in the CGM CLININET rsyncd service allows an attacker who can spoof an allow-listed source IP addr
Code injection in the ConvExpr function of CGM CLININET allows a high-privileged, authenticated user to execute arbitrar
CGM CLININET stores user passwords as unsalted MD5 hashes, so once a credential store is obtained the passwords can be r
CGM CLININET exposes its /DocManagment endpoint without an authentication check, allowing unauthenticated attackers on a
CGM CLININET before 2026.MS3 exposes production database and RabbitMQ broker credentials to any local account because th
Reflected cross-site scripting in CGM CLININET (confirmed through version 2026.MS3, with later releases possibly affecte
Exploit-DB