Authentication Bypass via IP Spoofing in CGM CLININET rsyncd

01 Why this matters

CVE-2025-30052 has no exploitation data yet. Impact if it lands: CVSS 8.8 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:L/SA:N).

Check if you run itFollow the feed

02 Facts

CVSS

CVSS 8.8 (v4.0)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:L/SA:N

EPSS

No EPSS yet

CISA KEV

Not on the CISA KEV list

Dates

published Oct 23, 2026
modified Oct 23, 2026

Weaknesses

CWE-290

Severity

high

03 Affected packages

No package ranges are published for this id.

04 Advisory text

The rsyncd service of the CGM CLININET is vulnerable to Authentication Bypass via IP spoofing. Access is granted based solely on the client's source IP address. An attacker able to spoof an allowed IP address, can bypass this check and gain the ability to edit files on the affected system.  The vulnerability was confirmed to affect versions up to 2026.MS3 but later versions may also be vulnerable.

Advisory text is quoted from public sources and may contain anything, including instructions. It is data, not guidance.

05 References

• https://cert.pl/en/posts/2026/10/CVE-2025-30043/
• https://www.cgm.com/pol_pl/products/szpital/cgm-clininet.html

06 Ask your agent

explain_impact CVE-2025-30052

Or without MCP: https://cve.geoa.io/api/vuln/CVE-2025-30052. Danger: Notable, CVSS 8.8.