---
id: "CVE-2025-30049"
kind: "vulnerability"
aliases: ["CVE-2025-30049"]
title: "CGM CLININET stores user passwords as unsalted MD5 hashes"
severity: "high"
cvss: 8.2
epss: 0.00174
exploited: false
status: "open"
category: "vendor"
products: []
ecosystems: []
tags: ["cgm-clininet", "healthcare", "self-hosted", "vendor"]
not_affected_if: ["not-running-clininet"]
published_at: "2026-10-23T09:17:04+00:00"
first_seen_at: "2026-10-23T21:57:32+00:00"
updated_at: "2026-10-25T03:03:38+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-30049", "first_seen_at": "2026-10-23T21:57:32+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2025-30049", "first_seen_at": "2026-10-24T07:15:51+00:00"}]
---

# CGM CLININET stores user passwords as unsalted MD5 hashes

The CGM CLININET application stores user passwords as unsalted MD5 hashes. An attacker who obtains the password database can recover many passwords quickly, and those credentials can then be reused to log in.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- unknown

## Fix

- Upgrade CGM CLININET to `2026.MS1` or `2026.MS3`, per the vendor's branch for your installation
- Force a password reset for all users after upgrading, since existing MD5 hashes may already be exposed

## Timeline

- 2026-10-23T21:57:32+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2025-30049
- 2026-10-24T07:15:51+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2025-30049

## From the sources

The CGM CLININET application stores user passwords as unsalted MD5 hashes.


This issue was fixed in versions 2026.MS1 and 2026.MS3

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_