{"id":"CVE-2025-30043","kind":"vulnerability","aliases":["CVE-2025-30043"],"related":[],"title":"CGM CLININET: unauthenticated access to patient document list and downloads","description":"CGM CLININET is vulnerable to Missing Authentication for Critical Function in the /DocManagment path. The endpoint is accessible without authentication, allowing an unauthenticated attacker in the adjacent network to retrieve the list of patient documents and download those documents. \n\n\nThis issue was fixed in version 2026.MS3","summary":"CGM CLININET exposes its /DocManagment endpoint without authentication. An attacker on the adjacent network can list and download patient documents.","severity":"high","cvss":7.1,"epss":0.00202,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["cgm-clininet","healthcare","patient-data","vendor"],"not_affected_if":["not-cgm-clininet"],"how_to_check":"- unknown","fix":"- Upgrade CGM CLININET to `2026.MS3` or later, per the sources.","status":"open","published_at":"2026-10-23T09:17:03+00:00","first_seen_at":"2026-10-23T21:57:32+00:00","triaged_at":"2026-10-25T03:31:21+00:00","updated_at":"2026-10-25T03:31:21+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-10-25T03:31:21Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade CGM CLININET to `2026.MS3` or later, per the sources.","reach":"network","title":"CGM CLININET: unauthenticated access to patient document list and downloads","impact":"high","summary":"CGM CLININET exposes its /DocManagment endpoint without authentication. An attacker on the adjacent network can list and download patient documents.","category":"vendor","nicknames":[],"who_cares":["cgm-clininet","healthcare","patient-data"],"confidence":0.6,"needs_auth":"no","worst_case":"Attacker lists and downloads patient documents without any credentials","analyst_note":"Find the vendor advisory or release notes for CGM CLININET 2026.MS3 to confirm the fix version, and how to check whether /DocManagment is exposed.","how_to_check":"- unknown","needs_analyst":true,"not_affected_if":["not-cgm-clininet"],"who_is_affected":"CGM CLININET deployments reachable from the adjacent network where the /DocManagment path is exposed. Sources do not say which installation settings expose the path, so unknown whether internet-facing or internal-only installs are affected. Teams not running CGM CLININET can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000562,"input_tokens":3362,"output_tokens":452,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2025':12A,15A '-30043':13A,16A '/docmanagment':29B,57C '2026':90C 'access':4A,62C 'adjac':37B,71C 'allow':65C 'attack':34B,68C 'authent':32B,51C,64C 'cgm':1A,18B,25B,45C 'cgm-clininet':17B 'clininet':2A,19B,26B,46C 'critic':53C 'cve':11A,14A 'data':23B 'document':7A,44B,79C,83C 'download':10A,42B,81C 'endpoint':30B,60C 'expos':27B 'fix':87C 'function':54C 'healthcar':20B 'issu':85C 'list':8A,40B,76C 'miss':50C 'ms3':91C 'network':38B,72C 'path':58C 'patient':6A,22B,43B,78C 'patient-data':21B 'retriev':74C 'unauthent':3A,67C 'vendor':24B 'version':89C 'vulner':48C 'without':31B,63C","nicknames":[],"mitigations":[],"who_affected":"CGM CLININET deployments reachable from the adjacent network where the /DocManagment path is exposed. Sources do not say which installation settings expose the path, so unknown whether internet-facing or internal-only installs are affected. Teams not running CGM CLININET can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T09:17:03+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cvd@cert.pl","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2025-30043","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-30043","severity":null,"published_at":"2026-10-23T09:17:03+00:00","modified_at":"2026-10-23T16:28:32+00:00","first_seen_at":"2026-10-23T21:57:32+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null},{"source":"epss","external_id":"CVE-2025-30043","url":"https://api.first.org/data/v1/epss?cve=CVE-2025-30043","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:51+00:00","fetched_at":"2026-10-24T07:15:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}