CVE-2025-30051 CGM CVE debrief

Who should care

Local system administrators and security teams responsible for CGM CLININET installations should assess exposure and prioritize patching to prevent credential exposure. They should verify patch deployment, assess local system account security, and restrict access to sensitive credentials to prevent misuse. Affected operator, platform, vulnerability-management, and security-team impact should be considered when prioritizing patching and mitigation efforts.

Why it matters

Insecure file permissions in CGM CLININET allow local accounts to read sensitive credentials, posing a medium-severity risk. Patching to version 2026.MS3 or later is recommended.

• Verify patch deployment to prevent credential exposure
• Assess local system account security to prevent unauthorized access
• Restrict access to sensitive credentials to prevent misuse

Technical summary

The CGM CLININET application stores production database login and password, as well as RabbitMQ broker credentials, in the SysIO.pl configuration file. Insecure file permissions make this file readable by any local account. This vulnerability allows local accounts to read sensitive credentials, posing a medium-severity risk. Patching to version 2026.MS3 or later is recommended to prevent unauthorized access to sensitive credentials. Local system administrators and security teams should assess exposure and prioritize patching.

Defensive priority

Medium-priority patching and verification recommended for local system administrators and security teams.

Recommended defensive actions

• Patch CGM CLININET to version 2026.MS3 or later
• Verify file permissions for SysIO.pl configuration file
• Restrict access to sensitive credentials
• Monitor local system accounts for unauthorized access
• Verify patch deployment to prevent credential exposure
• Assess local system account security to prevent unauthorized access
• Review compensating controls for exposed systems while remediation is scheduled and verified

Evidence notes

Official CVE Program record and NVD vulnerability detail page confirm the insecure file permissions issue in CGM CLININET. Vendor documentation and a third-party advisory provide additional context. The issue was fixed in version 2026.MS3. Defenders should verify patch deployment and assess local system account security to prevent unauthorized access.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.