What’s Vulnerable › Vulnerabilities

CVE-2025-30043: Missing Authentication in CGM CLININET

• Severity: high (CVSS 7.1 v4.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-10-23 · updated 2026-10-28
• Weakness: CWE-306

Description

CGM CLININET is vulnerable to Missing Authentication for Critical Function in the /DocManagment path. The endpoint is accessible without authentication, allowing an unauthenticated attacker in the adjacent network to retrieve the list of patient documents and download those documents.  This issue was fixed in version 2026.MS3

Affected products

• CGM CLININET: before 2026.MS3 — fixed in 2026.MS3

How to fix

Upgrade to a fixed version: CGM CLININET 2026.MS3. Check the vendor advisory for mitigations.

References

• https://cert.pl/en/posts/2026/10/CVE-2025-30043/
• https://www.cgm.com/pol_pl/products/szpital/cgm-clininet.html

Get alerted when CVE-2025-30043 or the next vulnerability affects your stack