Platform
other
Component
cgm-clininet
Fixed in
2025.MS4
CVE-2025-30035 represents a critical authentication bypass vulnerability discovered in CGM CLININET. This flaw allows attackers to completely bypass authentication mechanisms, granting them unauthorized access to user accounts with minimal effort. The vulnerability affects versions 0 through 2025.MS4 and has been addressed with the release of version 2025.MS4.
The impact of CVE-2025-30035 is severe. An attacker can exploit this vulnerability to gain full access to any active user account within the CGM CLININET system simply by providing the username. This bypass circumvents standard authentication procedures, eliminating the need for passwords or other credentials. Successful exploitation results in session takeover, allowing the attacker to operate with the privileges of the compromised user. This could lead to unauthorized access to sensitive patient data, modification of clinical records, or disruption of critical healthcare operations. The potential for widespread data breaches and operational downtime makes this a high-priority security concern.
CVE-2025-30035 was publicly disclosed on 2026-03-02. The vulnerability's simplicity suggests a high probability of exploitation (EPSS score likely medium to high). Public proof-of-concept exploits are anticipated given the ease of exploitation. No confirmed active campaigns have been reported at the time of writing, but the vulnerability's severity warrants proactive monitoring and mitigation.
Exploit Status
EPSS
0.05% (15% percentile)
CISA SSVC
The primary mitigation for CVE-2025-30035 is to immediately upgrade CGM CLININET to version 2025.MS4 or later. If an immediate upgrade is not feasible due to compatibility issues or system downtime constraints, consider implementing temporary workarounds. While no direct workaround can fully prevent the authentication bypass, restricting network access to the CLININET server and implementing strict user access controls can limit the potential impact. Monitor user activity closely for any suspicious behavior. After upgrading, confirm the fix by attempting to authenticate with a valid username without providing a password; authentication should fail.
Update CGM CLININET to version 2025.MS4 or later. This update corrects the lack of authentication in the API that allows session generation for any user.
Vulnerability analysis and critical alerts directly to your inbox.
CVE-2025-30035 is a critical vulnerability in CGM CLININET allowing attackers to bypass authentication by only providing a username, gaining access to any user account.
If you are using CGM CLININET versions 0–2025.MS4, you are potentially affected by this vulnerability and should upgrade immediately.
The recommended fix is to upgrade to CGM CLININET version 2025.MS4 or later. If immediate upgrade is not possible, implement temporary access controls.
While no confirmed active campaigns have been reported, the vulnerability's simplicity suggests a high probability of exploitation and proactive mitigation is recommended.
Refer to the official CGM CLININET security advisory for detailed information and updates regarding CVE-2025-30035.
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.