{"id":"CVE-2025-30051","kind":"vulnerability","aliases":["CVE-2025-30051"],"related":[],"title":"CGM CLININET: database and RabbitMQ credentials readable by any local account","description":"The CGM CLININET application stores the production database login and password, as well as RabbitMQ broker credentials, in the SysIO.pl configuration file. Insecure file permissions make this file readable by any local account. \n\n\nThis issue was fixed in version 2026.MS3","summary":"CGM CLININET stores the production database login and password, plus RabbitMQ broker credentials, in the SysIO.pl configuration file. Insecure file permissions let any local account read those credentials.","severity":"medium","cvss":6.8,"epss":0.00098,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["cgm-clininet","healthcare-it","on-prem","other"],"not_affected_if":["fixed-version-2026.ms3","single-user-host"],"how_to_check":null,"fix":"- Upgrade CGM CLININET to `2026.MS3` or later.\n- Until then, restrict read access to SysIO.pl so only the service account can read it (the sources do not give the exact path or command).","status":"open","published_at":"2026-10-23T09:17:04+00:00","first_seen_at":"2026-10-23T21:57:32+00:00","triaged_at":"2026-10-25T03:42:36+00:00","updated_at":"2026-10-25T03:42:36+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-10-25T03:42:36Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade CGM CLININET to `2026.MS3` or later.\n- Until then, restrict read access to SysIO.pl so only the service account can read it (the sources do not give the exact path or command).","reach":"local","title":"CGM CLININET: database and RabbitMQ credentials readable by any local account","impact":"high","summary":"CGM CLININET stores the production database login and password, plus RabbitMQ broker credentials, in the SysIO.pl configuration file. Insecure file permissions let any local account read those credentials.","category":"other","nicknames":[],"who_cares":["cgm-clininet","healthcare-it","on-prem"],"confidence":0.6,"needs_auth":"yes","worst_case":"local user reads database and broker credentials from SysIO.pl","analyst_note":"Confirm the affected version range and the SysIO.pl location and permissions from the NVD entry or the vendor advisory; the sources do not give either.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["fixed-version-2026.MS3","single-user-host"],"who_is_affected":"Installations of CGM CLININET older than 2026.MS3 where the SysIO.pl file is readable by local users. An attacker needs a local account on the host to read the stored credentials, and the sources do not say whether the database or broker is reachable from outside. Sites that have already upgraded to 2026.MS3 are not affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000597,"input_tokens":3335,"output_tokens":526,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2025':13A,16A '-30051':14A,17A '2026':94C 'account':11A,51B,87C 'applic':58C 'broker':38B,70C 'cgm':1A,19B,27B,56C 'cgm-clininet':18B 'clininet':2A,20B,28B,57C 'configur':43B,75C 'credenti':6A,39B,54B,71C 'cve':12A,15A 'databas':3A,32B,62C 'file':44B,46B,76C,78C,82C 'fix':91C 'healthcar':22B 'healthcare-it':21B 'insecur':45B,77C 'issu':89C 'let':48B 'local':10A,50B,86C 'login':33B,63C 'make':80C 'ms3':95C 'on-prem':24B 'password':35B,65C 'permiss':47B,79C 'plus':36B 'prem':26B 'product':31B,61C 'rabbitmq':5A,37B,69C 'read':52B 'readabl':7A,83C 'store':29B,59C 'sysio.pl':42B,74C 'version':93C 'well':67C","nicknames":[],"mitigations":[],"who_affected":"Installations of CGM CLININET older than 2026.MS3 where the SysIO.pl file is readable by local users. An attacker needs a local account on the host to read the stored credentials, and the sources do not say whether the database or broker is reachable from outside. Sites that have already upgraded to 2026.MS3 are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T09:17:04+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cvd@cert.pl","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2025-30051","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-30051","severity":null,"published_at":"2026-10-23T09:17:04+00:00","modified_at":"2026-10-23T16:28:32+00:00","first_seen_at":"2026-10-23T21:57:32+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null},{"source":"epss","external_id":"CVE-2025-30051","url":"https://api.first.org/data/v1/epss?cve=CVE-2025-30051","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:51+00:00","fetched_at":"2026-10-24T07:15:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}