---
id: "CVE-2025-30052"
kind: "vulnerability"
aliases: ["CVE-2025-30052"]
title: "CGM CLININET rsyncd: IP spoofing bypasses auth, allows file edits"
severity: "high"
cvss: 8.8
epss: 0.00342
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "CGM CLININET", "fixed": [], "affected": "<= 2026.MS3", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["cgm-clininet", "healthcare-it", "infrastructure", "on-prem", "rsync", "self-hosted"]
not_affected_if: ["no-cgm-clininet-deployment", "rsync-port-unreachable", "rsyncd-not-running"]
published_at: "2026-10-23T09:17:05+00:00"
first_seen_at: "2026-10-23T21:57:32+00:00"
updated_at: "2026-10-24T07:15:51+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-30052", "first_seen_at": "2026-10-23T21:57:32+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T23:36:31+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2025-30052", "first_seen_at": "2026-10-24T07:15:51+00:00"}]
---

# CGM CLININET rsyncd: IP spoofing bypasses auth, allows file edits

The rsyncd service in CGM CLININET (hospital information system) allows access based only on the client's source IP. An attacker able to spoof an allowed IP, e.g. from the adjacent network, can edit files on the server. Affects all versions through 2026.MS3; later versions may also be affected. Reported by Maciej Kazulak via CERT Polska.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:CGM CLININET affected <= 2026.MS3 fixed ?

## How to check

Check the installed CLININET version (2026.MS3 or earlier is affected). On the server, check whether rsyncd is running and listening on TCP 873 (ss -ltnp | grep 873), and review the rsyncd.conf 'hosts allow' entries: if IP allow-listing is the only control, you are exposed.

## Fix

unknown: CERT Polska and CVE list no fixed version or configuration fix for this CVE. Contact CGM support for a patched build. Interim, standard hardening (not vendor-confirmed): block TCP 873 at the network edge and between segments except from known hosts, enforce anti-spoofing/ingress filtering, and restrict rsyncd to a management VLAN or tunnel it.

## Timeline

- 2026-10-23T21:57:32+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2025-30052
- 2026-10-23T23:36:31+00:00 analyst — Primary source CERT Polska (coordinated disclosure, 2026-10-23): CVE-2025-30052 affects all CGM CLININET through 2026.MS3; unlike siblings (30043/30047/30050/30051 fixed in 2026.MS3), no fixed version or rsyncd config fix is published. No vendor advisory found; CGM product page only. No PoC or exploitation found; social search skipped (brand-new, niche). Siblings from same report: 30043-30054, 58403.
- 2026-10-24T07:15:51+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2025-30052

## Documents

- [advisory] CERT Polska: Vulnerabilities in CGM CLININET software https://cert.pl/en/posts/2026/10/CVE-2025-30043/
- [describes] CVE Record: CVE-2025-30052 https://www.cve.org/CVERecord?id=CVE-2025-30052

## From the sources

The rsyncd service of the CGM CLININET is vulnerable to Authentication Bypass via IP spoofing. Access is granted based solely on the client's source IP address. An attacker able to spoof an allowed IP address, can bypass this check and gain the ability to edit files on the affected system. 


The vulnerability was confirmed to affect versions up to 2026.MS3 but later versions may also be vulnerable.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_