{"id":"CVE-2025-30049","kind":"vulnerability","aliases":["CVE-2025-30049"],"related":[],"title":"CGM CLININET stores user passwords as unsalted MD5 hashes","description":"The CGM CLININET application stores user passwords as unsalted MD5 hashes.\n\n\nThis issue was fixed in versions 2026.MS1 and 2026.MS3","summary":"The CGM CLININET application stores user passwords as unsalted MD5 hashes. An attacker who obtains the password database can recover many passwords quickly, and those credentials can then be reused to log in.","severity":"high","cvss":8.2,"epss":0.00174,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["cgm-clininet","healthcare","self-hosted","vendor"],"not_affected_if":["not-running-clininet"],"how_to_check":"- unknown","fix":"- Upgrade CGM CLININET to `2026.MS1` or `2026.MS3`, per the vendor's branch for your installation\n- Force a password reset for all users after upgrading, since existing MD5 hashes may already be exposed","status":"open","published_at":"2026-10-23T09:17:04+00:00","first_seen_at":"2026-10-23T21:57:32+00:00","triaged_at":"2026-10-25T03:03:38+00:00","updated_at":"2026-10-25T03:03:38+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-10-25T03:03:38Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade CGM CLININET to `2026.MS1` or `2026.MS3`, per the vendor's branch for your installation\n- Force a password reset for all users after upgrading, since existing MD5 hashes may already be exposed","reach":"unknown","title":"CGM CLININET stores user passwords as unsalted MD5 hashes","impact":"high","summary":"The CGM CLININET application stores user passwords as unsalted MD5 hashes. An attacker who obtains the password database can recover many passwords quickly, and those credentials can then be reused to log in.","category":"vendor","nicknames":[],"who_cares":["cgm-clininet","healthcare","self-hosted"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker recovers user passwords from the stored hash table","analyst_note":"Confirm which CLININET deployment modes are exposed and whether the vendor advisory lists the affected version ranges, via the NVD entry https://nvd.nist.gov/vuln/detail/CVE-2025-30049.","how_to_check":"- unknown","needs_analyst":true,"not_affected_if":["not-running-clininet"],"who_is_affected":"Organisations running CGM CLININET versions before the fixed releases. The sources do not say which deployment modes or configurations are exposed, so the exact exposure path is unknown. Teams not running CLININET can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000591,"input_tokens":3301,"output_tokens":521,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2025':11A,14A '-30049':12A,15A '2026':73C,76C 'applic':27B,59C 'attack':36B 'cgm':1A,17B,25B,57C 'cgm-clininet':16B 'clininet':2A,18B,26B,58C 'credenti':49B 'cve':10A,13A 'databas':41B 'fix':70C 'hash':9A,34B,66C 'healthcar':19B 'host':22B 'issu':68C 'log':55B 'mani':44B 'md5':8A,33B,65C 'ms1':74C 'ms3':77C 'obtain':38B 'password':5A,30B,40B,45B,62C 'quick':46B 'recov':43B 'reus':53B 'self':21B 'self-host':20B 'store':3A,28B,60C 'unsalt':7A,32B,64C 'user':4A,29B,61C 'vendor':23B 'version':72C","nicknames":[],"mitigations":[],"who_affected":"Organisations running CGM CLININET versions before the fixed releases. The sources do not say which deployment modes or configurations are exposed, so the exact exposure path is unknown. Teams not running CLININET can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T09:17:04+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cvd@cert.pl","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2025-30049","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-30049","severity":null,"published_at":"2026-10-23T09:17:04+00:00","modified_at":"2026-10-23T16:28:32+00:00","first_seen_at":"2026-10-23T21:57:32+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null},{"source":"epss","external_id":"CVE-2025-30049","url":"https://api.first.org/data/v1/epss?cve=CVE-2025-30049","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:51+00:00","fetched_at":"2026-10-24T07:15:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}