CVE-2025-30053

The CGM CLININET application runs the cgm-updater process listening on an open network port without any authentication. The vulnerability was confirmed to affect versions up to 2026.MS3. Version 2026.MS3 with the updater-upkg component in version 5.3.0 or higher is not affected by this vulnerability.

CVSS

No CVSS.

References

Link	Resource
https://cert.pl/en/posts/2026/10/CVE-2025-30043/
https://www.cgm.com/pol_pl/products/szpital/cgm-clininet.html

Configurations

No configuration.

History

28 Oct 2026, 14:16

Type	Values Removed	Values Added
Summary	(en) The CGM CLININET application runs the cgm-updater process listening on an open network port without any authentication. The vulnerability was confirmed to affect versions up to 2026.MS3 but later versions may also be vulnerable.	(en) The CGM CLININET application runs the cgm-updater process listening on an open network port without any authentication. The vulnerability was confirmed to affect versions up to 2026.MS3. Version 2026.MS3 with the updater-upkg component in version 5.3.0 or higher is not affected by this vulnerability.

28 Oct 2026, 14:10

Type	Values Removed	Values Added
Summary		(es) La aplicación CGM CLININET ejecuta el proceso cgm-updater escuchando en un puerto de red abierto sin ninguna autenticación.\n\nLa vulnerabilidad se confirmó que afecta hasta la versión 2026.MS3 incluida, pero versiones posteriores también pueden ser vulnerables.

23 Oct 2026, 09:17

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-10-23 09:17

Updated : 2026-10-28 20:17

NVD link : CVE-2025-30053

Mitre link : CVE-2025-30053

CVE.ORG link : CVE-2025-30053

JSON object : View

Products Affected

No product.

CWE

CWE-306

Missing Authentication for Critical Function

{"id": "CVE-2025-30053", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-30053", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-28T18:23:49.715395Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "cvd@cert.pl", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6.9, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "cvd@cert.pl", "affectedData": [{"vendor": "CGM", "modules": ["cgm-updater"], "product": "CGM CLININET", "versions": [{"status": "affected", "changes": [{"at": "updater-upkg module update to version 5.3.0", "status": "unaffected"}], "version": "0", "versionType": "custom", "lessThanOrEqual": "2026.MS3"}], "defaultStatus": "unaffected"}]}], "published": "2026-10-23T09:17:05.170", "references": [{"url": "https://cert.pl/en/posts/2026/10/CVE-2025-30043/", "source": "cvd@cert.pl"}, {"url": "https://www.cgm.com/pol_pl/products/szpital/cgm-clininet.html", "source": "cvd@cert.pl"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "cvd@cert.pl", "description": [{"lang": "en", "value": "CWE-306"}]}], "descriptions": [{"lang": "en", "value": "The CGM CLININET application runs the cgm-updater process listening on an open network port without any authentication.\n\n\n\n\nThe vulnerability was confirmed to affect versions up to\u00a02026.MS3.\u00a0Version\u00a02026.MS3\u00a0with the updater-upkg component in version 5.3.0 or higher is not affected by this vulnerability."}, {"lang": "es", "value": "La aplicaci\u00f3n CGM CLININET ejecuta el proceso cgm-updater escuchando en un puerto de red abierto sin ninguna autenticaci\u00f3n.\\n\\nLa vulnerabilidad se confirm\u00f3 que afecta hasta la versi\u00f3n 2026.MS3 incluida, pero versiones posteriores tambi\u00e9n pueden ser vulnerables."}], "lastModified": "2026-10-28T20:17:16.493", "sourceIdentifier": "cvd@cert.pl"}