CVE-2025-30052 CGM CVE debrief

Who should care

Defenders responsible for CGM CLININET systems should assess exposure and prioritize verification of affected versions and implementation of IP spoofing mitigations. Security teams need to review the vulnerability details and coordinate with system administrators to ensure proper mitigation. Operators of CGM CLININET systems should verify their versions and implement necessary security measures. Vulnerability management teams should track this issue and  

Why it matters

The CGM CLININET rsyncd service is vulnerable to authentication bypass via IP spoofing, allowing an attacker to edit files on the affected system. Defenders should prioritize verifying the affected versions and implementing IP spoofing mitigations.

• An attacker could edit files on the affected system by spoofing an allowed IP address.
• Defenders need to verify the affected versions of CGM CLININET and implement IP spoofing mitigations.
• The vulnerability could be used to gain unauthorized access to the system.

Technical summary

The rsyncd service of the CGM CLININET is vulnerable to authentication bypass via IP spoofing. Access is granted based solely on the client's source IP address. An attacker able to spoof an allowed IP address can bypass this check and gain the ability to edit files on the affected system. The vulnerability was confirmed to affect versions up to 2026.MS3, but later versions may also be vulnerable. This weakness in authentication can lead to unauthorized access and potential further exploitation if not properly addressed.

Defensive priority

Defenders should prioritize verifying the affected versions of CGM CLININET and implementing IP spoofing mitigations.

Recommended defensive actions

• Verify the version of CGM CLININET and check if it is affected by the vulnerability
• Implement IP spoofing mitigations, such as IP address filtering or authentication mechanisms
• Monitor system logs for suspicious activity
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE Program record and NVD vulnerability detail page provide official information about the vulnerability. The source item and supplemental sources offer additional context. Evidence is limited to public sources and may not reflect the full scope of affected systems or potential impacts. Defenders should verify the affected versions of CGM CLININET and implement IP spoofing mitigations. The vulnerability was confirmed in versions up to 2026.MS3, but later versions may also be vulnerable.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.