CGM CLININET: Authentication bypass via IP spoofing in rsyncd
Summary
The rsyncd service of CGM CLININET, a hospital information system, grants file write access based solely on the client's source IP address. An attacker who spoofs an allowed IP address can bypass this check and edit files on the affected system. The CVSS vector assumes no privileges and no user interaction and rates the integrity and availability impact as high, with no confidentiality impact. Exposure depends on whether the rsyncd service is reachable from the attacker's network segment.
Affected
- CGM CLININET up to and including 2026.MS3 according to the CVE record.
- The CERT Polska advisory lists this CVE as affecting versions up to 2026.MS4. Treat MS4 as possibly affected until the vendor clarifies.
- Later versions may also be vulnerable.
Fixed in
Unknown. No vendor fix statement for this CVE was found.
Workaround
- Restrict rsyncd access to the hosts that the vendor documents as required, ideally on a protected management network.
- IP allow lists alone are not sufficient, because the flaw is exactly a bypass by spoofing. Add anti-spoofing controls such as port security, DHCP snooping and ARP inspection on the segment.
- Confirm any configuration change with CGM first, since this is clinical software.
Exploitation
- No known exploitation according to the sources reviewed.
- No public proof of concept identified.
- CISA SSVC: exploitation none, automatable yes, technical impact partial.
Our recommendation
- Ask CGM whether your installation is affected and which build fixes this CVE.
- Restrict rsyncd to the vendor-documented hosts at firewall and switch level.
- Apply anti-spoofing controls on the network segment.
- Log rsyncd activity and check file integrity on the server.
- Assess the other CLININET CVEs from the same CERT Polska batch, especially CVE-2025-30043 and CVE-2025-30050, as they are more severe.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CERT Polska advisory: Vulnerabilities in CGM CLININET software cert.pl
- CGM CLININET product page www.cgm.com
- Strix AI: CVE-2025-30052 www.strix.ai
- Safeguard: CGM CLININET analysis safeguard.sh
- VulDB: CVE-2025-30052 vuldb.com
- HOL Guard: CVE-2025-30052 hol.org
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 10:51.
Original description (NVD)
The rsyncd service of the CGM CLININET is vulnerable to Authentication Bypass via IP spoofing. Access is granted based solely on the client's source IP address. An attacker able to spoof an allowed IP address, can bypass this check and gain the ability to edit files on the affected system. The vulnerability was confirmed to affect versions up to 2026.MS3 but later versions may also be vulnerable.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.