CGM CLININET EUVD-2025-211175

The /DocManagment endpoint of CGM CLININET is exposed without any authentication check, so an attacker needs only network reachability to that endpoint to list and download patient documents - no credentials, no user interaction, and no special product configuration are required per the description. The principal limiting factor is the Adjacent (AV:A) attack vector: the attacker must already be on the same adjacent/local network segment as the CLININET server rather than reaching it across the open internet, so realistic risk is confined to internal actors or attackers who have already breached the hospital network. Fixed in version 2026.MS3; the description states no partial mitigation other than the fix.

This is a credible, near-term priority for affected healthcare environments, but not an internet-wide emergency. The CVSS 4.0 vector (AV:A/AC:L/AT:N/PR:N/UI:N/VC:H) confirms low-complexity, unauthenticated exploitation with high confidentiality impact, and the vuln.today Decision label is 'this_week' - consistent with a serious but not 'act now' urgency. The key limiting signal is the Adjacent (AV:A) attack vector: exploitation requires a foothold on the same logical network segment rather than direct internet reach, which materially narrows the attacker population to insiders, compromised internal hosts, or attackers who have already breached the hospital network perimeter. No EPSS score, KEV listing, or PoC is present in the supplied data, so there is no evidence of active exploitation or published exploit code; exploitation status is therefore 'no public exploit identified at time of analysis'. The impact is purely confidentiality (VI/VA:N) - mass disclosure of patient medical documents - which carries high regulatory and privacy consequences (GDPR/healthcare data) even though it does not compromise system integrity or availability. The signals are internally consistent: there is no CVSS-versus-description conflict and no over-inflated severity here; the 7.1 score is driven down from critical precisely because the vector is adjacent and impact is confidentiality-only.

An attacker who has gained a position on the hospital's internal or adjacent network (e.g., a compromised workstation, rogue device, or malicious insider) sends an unauthenticated request to the /DocManagment endpoint of a CGM CLININET server. Because the endpoint requires no authentication, the attacker enumerates the list of patient documents and downloads them directly. No public exploit code or PoC is identified in the available data; exploitation requires only a standard HTTP client and adjacent-network access.