PatchSiren

PatchSiren cyber security CVE debrief

CVE-2025-30043 CGM CVE debrief

PatchSiren debrief for CVE-2025-30043: The CGM CLININET system has a vulnerability in the /DocManagment path, allowing unauthenticated attackers to retrieve and download patient documents. This issue was fixed in version 2026.MS3. Healthcare organizations and IT staff responsible for CGM CLININET systems should assess exposure and apply necessary fixes. The vulnerability poses a high risk to healthcare organizations due to the potential for unauthorized access to sensitive patient information.

Vendor
CGM
Product
CGM CLININET
CVSS
HIGH 7.1
CISA KEV
Not listed in stored evidence
Original CVE published
2026-10-23
Original CVE updated
2026-10-28
Advisory published
2026-10-23
Advisory updated
2026-10-28

Who should care

Healthcare organizations and IT staff responsible for CGM CLININET systems should assess exposure and apply necessary fixes. This includes reviewing network configurations, verifying authentication mechanisms, and ensuring that the fix in version 2026.MS3 or later is applied. Additionally, organizations should assess the potential impact on patient document access controls and logging mechanisms.

Why it matters

CVE-2025-30043 allows unauthenticated access to patient documents in CGM CLININET, posing a high risk to healthcare organizations.

  • Verify authentication mechanisms for /DocManagment path
  • Assess network exposure to adjacent network attackers
  • Review patient document access controls and logging
  • Ensure version 2026.MS3 or later is applied

Technical summary

The CGM CLININET system has a vulnerability in the /DocManagment path, allowing unauthenticated attackers to retrieve and download patient documents. This issue arises from a missing authentication mechanism, which can be exploited by attackers in the adjacent network. The vulnerability is addressed in version 2026.MS3 or later, where the necessary authentication controls are implemented to prevent unauthorized access to patient documents. Healthcare organizations should prioritize applying this fix to prevent potential breaches.

Defensive priority

Healthcare organizations using CGM CLININET should verify their inventory and assess exposure to this vulnerability.

Recommended defensive actions

  • Verify CGM CLININET inventory and assess exposure to CVE-2025-30043
  • Review network configurations to ensure the /DocManagment path is properly secured
  • Apply the fix in version 2026.MS3 or later
  • Verify authentication mechanisms for /DocManagment path
  • Assess network exposure to adjacent network attackers
  • Review patient document access controls and logging
  • Ensure version 2026.MS3 or later is applied

Evidence notes

The CVE record and source item provide details on the missing authentication vulnerability in CGM CLININET, which allows unauthenticated attackers to retrieve patient documents. The vulnerability is confirmed in the /DocManagment path, and the fix is available in version 2026.MS3 or later. Defenders should verify the affected scope, assess network exposure, and review patient document access controls.

Sources and references

Verified primary and authoritative sources

  • CVE-2025-30043 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2025-30043

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2025-30043 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2025-30043

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Missing Authentication in CGM CLININET

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/30xxx/CVE-2025-30043.json

    cve_program_cvelist_v5

  • Source reference

    Unverified legacy reference

    URL: https://cert.pl/en/posts/2026/10/CVE-2025-30043/

    Supplemental source - third-party-advisory

  • Source reference

    Unverified legacy reference

    URL: https://www.cgm.com/pol_pl/products/szpital/cgm-clininet.html

    Supplemental source - product

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.