Insecure Configuration Management in CGM CLININET Application
CVE-2025-30051

6.8MEDIUM

Key Information:

Vendor

Cgm

Status
Cgm Clininet
Vendor
CVE Published:
23 October 2026

What is CVE-2025-30051?

The CGM CLININET application has a vulnerability that allows the storage of sensitive information such as production database login credentials and RabbitMQ broker credentials within an insecure configuration file, SysIO.pl. Due to incorrect file permissions, this file is accessible to any local account, posing a significant risk of unauthorized access. This issue was addressed in version 2026.MS3.

Affected Version(s)

CGM CLININET 0 < 2026.MS3

References

https://cert.pl/en/posts/2026/10/CVE-2025-30043/
third-party-advisory
https://www.cgm.com/pol_pl/products/szpital/cgm-clininet....
product

CVSS V4

Score:
6.8
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
None
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.