{"id":"CVE-2025-30052","kind":"vulnerability","aliases":["CVE-2025-30052"],"related":[],"title":"CGM CLININET rsyncd: IP spoofing bypasses auth, allows file edits","description":"The rsyncd service of the CGM CLININET is vulnerable to Authentication Bypass via IP spoofing. Access is granted based solely on the client's source IP address. An attacker able to spoof an allowed IP address, can bypass this check and gain the ability to edit files on the affected system. \n\n\nThe vulnerability was confirmed to affect versions up to 2026.MS3 but later versions may also be vulnerable.","summary":"The rsyncd service in CGM CLININET (hospital information system) allows access based only on the client's source IP. An attacker able to spoof an allowed IP, e.g. from the adjacent network, can edit files on the server. Affects all versions through 2026.MS3; later versions may also be affected. Reported by Maciej Kazulak via CERT Polska.","severity":"high","cvss":8.8,"epss":0.00342,"exploited":false,"exploited_at":null,"products":[{"name":"CGM CLININET","fixed":[],"affected":"<= 2026.MS3","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["cgm-clininet","healthcare-it","infrastructure","on-prem","rsync","self-hosted"],"not_affected_if":["no-cgm-clininet-deployment","rsync-port-unreachable","rsyncd-not-running"],"how_to_check":"Check the installed CLININET version (2026.MS3 or earlier is affected). On the server, check whether rsyncd is running and listening on TCP 873 (ss -ltnp | grep 873), and review the rsyncd.conf 'hosts allow' entries: if IP allow-listing is the only control, you are exposed.","fix":"unknown: CERT Polska and CVE list no fixed version or configuration fix for this CVE. Contact CGM support for a patched build. Interim, standard hardening (not vendor-confirmed): block TCP 873 at the network edge and between segments except from known hosts, enforce anti-spoofing/ingress filtering, and restrict rsyncd to a management VLAN or tunnel it.","status":"open","published_at":"2026-10-23T09:17:05+00:00","first_seen_at":"2026-10-23T21:57:32+00:00","triaged_at":"2026-10-23T22:31:30+00:00","updated_at":"2026-10-24T07:15:51+00:00","category":"infrastructure","confidence":0.8,"triage":{"at":"2026-10-23T22:31:30Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"CGM CLININET rsyncd: IP spoofing bypasses auth, allows file edits","impact":"high","summary":"The rsyncd service in CGM CLININET grants access based only on the client's source IP address. An attacker who can spoof an allowed IP address bypasses the check and gains the ability to edit files on the system.","category":"infrastructure","who_cares":["cgm-clininet","healthcare-it","rsync"],"confidence":0.7,"needs_auth":"no","worst_case":"Attacker edits files on the CLININET system after spoofing an allowed IP.","analyst_note":"Find the vendor patched version and the rsyncd configuration fix from CGM; the sources give neither, and the source URL is only the NVD entry.","how_to_check":"Check whether CGM CLININET runs an rsyncd service and which version is installed; the sources confirm versions up to 2026.MS3 are affected and later versions may be too.","needs_analyst":true,"not_affected_if":["no-cgm-clininet-deployment"],"user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000498,"input_tokens":2970,"output_tokens":402,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the vendor patched version and the rsyncd configuration fix from CGM; the sources give neither, and the source URL is only the NVD entry.","search":"'-2025':12A,15A '-30052':13A,16A '2026':75B,150C 'abil':133C 'abl':54B,119C 'access':43B,105C 'address':116C,125C 'adjac':63B 'affect':71B,82B,139C,146C 'allow':8A,42B,58B,123C 'also':80B,156C 'attack':53B,118C 'auth':7A 'authent':100C 'base':44B,108C 'bypass':6A,101C,127C 'cert':88B 'cgm':1A,17A,20B,37B,95C 'cgm-clininet':19B 'check':129C 'client':48B,112C 'clininet':2A,18A,21B,38B,96C 'confirm':144C 'cve':11A,14A 'e.g':60B 'edit':10A,66B,135C 'file':9A,67B,136C 'gain':131C 'grant':107C 'healthcar':23B 'healthcare-it':22B 'hospit':39B 'host':32B 'inform':40B 'infrastructur':25B 'ip':4A,51B,59B,103C,115C,124C 'kazulak':86B 'later':77B,153C 'maciej':85B 'may':79B,155C 'ms3':76B,151C 'network':64B 'on-prem':26B 'polska':89B 'prem':28B 'report':83B 'rsync':29B 'rsyncd':3A,34B,91C 'self':31B 'self-host':30B 'server':70B 'servic':35B,92C 'sole':109C 'sourc':50B,114C 'spoof':5A,56B,104C,121C 'system':41B,140C 'version':73B,78B,147C,154C 'via':87B,102C 'vulner':98C,142C,158C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T09:17:05+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cvd@cert.pl","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2025-30052","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-30052","severity":null,"published_at":"2026-10-23T09:17:05+00:00","modified_at":"2026-10-23T16:28:32+00:00","first_seen_at":"2026-10-23T21:57:32+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null},{"source":"analyst","external_id":"CVE-2025-30052:480","url":null,"severity":null,"published_at":"2026-10-23T23:36:31+00:00","modified_at":"2026-10-23T23:36:31+00:00","first_seen_at":"2026-10-23T23:36:31+00:00","fetched_at":"2026-10-23T23:36:31+00:00","note":"Primary source CERT Polska (coordinated disclosure, 2026-10-23): CVE-2025-30052 affects all CGM CLININET through 2026.MS3; unlike siblings (30043/30047/30050/30051 fixed in 2026.MS3), no fixed version or rsyncd config fix is published. No vendor advisory found; CGM product page only. No PoC or exploitation found; social search skipped (brand-new, niche). Siblings from same report: 30043-30054, 58403."},{"source":"epss","external_id":"CVE-2025-30052","url":"https://api.first.org/data/v1/epss?cve=CVE-2025-30052","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:51+00:00","fetched_at":"2026-10-24T07:15:51+00:00","note":null}],"documents":[{"id":1323,"url":"https://cert.pl/en/posts/2026/10/CVE-2025-30043/","title":"CERT Polska: Vulnerabilities in CGM CLININET software","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":2069,"url":"https://www.cve.org/CVERecord?id=CVE-2025-30052","title":"CVE Record: CVE-2025-30052","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}