CVE-2025-30049 CGM CVE debrief

Who should care

Defenders responsible for CGM CLININET systems should assess exposure and prioritize upgrading to a fixed version to mitigate potential password cracking risks. This includes IT security teams, system administrators, and operators who manage CGM CLININET deployments. They should review their current configurations, verify if their systems use unsalted MD5 password hashes, and take immediate action to upgrade to a secure version or implement compensating

Why it matters

Defenders should care about CVE-2025-30049 because it involves a security risk due to the use of unsalted MD5 password hashes in CGM CLININET, which can lead to potential password cracking and requires upgrading to a fixed version.

• Password storage security risk
• Potential for password cracking
• Need for upgrading to a fixed version

Technical summary

The CGM CLININET application stores user passwords as unsalted MD5 hashes, which can be a security risk due to the potential for password cracking. This vulnerability was fixed in versions 2026.MS1 and 2026.MS3. Defenders should prioritize verifying if their CGM CLININET systems use unsalted MD5 password hashes and upgrade to a fixed version. The use of unsalted MD5 hashes for password storage is a known vulnerability that can be exploited by attackers. Affected organizations should review their current configurations and take immediate action to mitigate potential risks.

Defensive priority

Defenders should prioritize verifying if their CGM CLININET systems use unsalted MD5 password hashes and upgrade to a fixed version.

Recommended defensive actions

• Verify if CGM CLININET systems use unsalted MD5 password hashes
• Upgrade to version 2026.MS1 or 2026.MS3 or later
• Consider implementing additional security measures for password storage
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and source item indicate that CGM CLININET uses unsalted MD5 password hashes, which is a security risk. The issue was fixed in versions 2026.MS1 and 2026.MS3. Defenders should verify if their CGM CLININET systems use unsalted MD5 password hashes and prioritize upgrading to a fixed version. The CVE Program record and NIST NVD detail page provide additional context on the vulnerability. However, the exact scope of affected systems and potential impact on organizations is not explicitly stated, requiring further review of

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.