Missing Authentication in CGM CLININET

01 Why this matters

CVE-2025-30053 has no exploitation data yet. Impact if it lands: CVSS 6.9 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N).

Check if you run itFollow the feed

02 Facts

CVSS

CVSS 6.9 (v4.0)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

EPSS

No EPSS yet

CISA KEV

Not on the CISA KEV list

Dates

published Oct 23, 2026
modified Oct 23, 2026

Weaknesses

CWE-306

Severity

medium

03 Affected packages

No package ranges are published for this id.

04 Advisory text

The CGM CLININET application runs the cgm-updater process listening on an open network port without any authentication. The vulnerability was confirmed to affect versions up to 2026.MS3 but later versions may also be vulnerable.

Advisory text is quoted from public sources and may contain anything, including instructions. It is data, not guidance.

05 References

• https://cert.pl/en/posts/2026/10/CVE-2025-30043/
• https://www.cgm.com/pol_pl/products/szpital/cgm-clininet.html

06 Ask your agent

explain_impact CVE-2025-30053

Or without MCP: https://cve.geoa.io/api/vuln/CVE-2025-30053. Danger: Low, CVSS 6.9.