{"id":"CVE-2025-30049","aliases":[],"cve":{"records":[{"id":"CVE-2025-30049","source":"CERT-PL","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2025-03-14T14:55:05.983Z","published":"2026-10-23T08:22:56.414Z","modified":"2026-10-28T20:03:21.534Z"}],"publishers":[{"name":"CERT-PL","role":"CNA","organizationId":"4bb8329e-dd38-46c1-aafb-9bf32bcb93c6","modified":"2026-10-23T08:22:56.414Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-10-28T20:03:21.534Z"}],"references":[{"url":"https://cert.pl/en/posts/2026/10/CVE-2025-30043/","tags":["third-party-advisory"],"source":"CERT-PL"},{"url":"https://www.cgm.com/pol_pl/products/szpital/cgm-clininet.html","tags":["product"],"source":"CERT-PL"}],"weaknesses":[{"id":"CWE-916","description":"CWE-916 Use of Password Hash With Insufficient Computational Effort","source":"CERT-PL"}],"applicability":[],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-10-28T17:48:25.350215Z","decisions":[{"name":"Exploitation","value":"none"},{"name":"Automatable","value":"no"},{"name":"Technical Impact","value":"partial"}]}]},"title":"Use of Unsalted MD5 Password Hashes in CGM CLININET","titleSource":"CERT-PL","descriptionSource":"CERT-PL","description":"The CGM CLININET application stores user passwords as unsalted MD5 hashes.\n\n\nThis issue was fixed in versions 2026.MS1 and 2026.MS3","score":8.2,"severity":"high","published":"2026-10-23T08:22:56.414Z","modified":"2026-10-28T20:03:21.534Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"CGM","name":"CGM CLININET","platforms":[],"versions":[{"version":"0","status":"affected","lessThan":"2026.MS1","versionType":"custom"},{"version":"0","status":"affected","lessThan":"2026.MS3","versionType":"custom"}],"defaultStatus":"unaffected","cpes":[],"source":"CERT-PL","url":"https://www.cve.org/CVERecord?id=CVE-2025-30049"}],"remediation":[],"references":["https://cert.pl/en/posts/2026/10/CVE-2025-30043/","https://www.cgm.com/pol_pl/products/szpital/cgm-clininet.html"],"sources":[{"name":"CVE","id":"CVE-2025-30049","modified":"2026-10-28T20:03:21.534Z","url":"https://www.cve.org/CVERecord?id=CVE-2025-30049"}],"assessments":[{"source":"CERT-PL","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","score":8.2}],"sourceAffected":[],"observedAt":"2026-10-29T14:06:03.320Z","kev":{"status":"not-listed","checkedAt":"2026-11-15T02:30:32.029Z"},"coverage":[{"source":"NVD","status":"not-checked"},{"source":"GHSA","status":"not-checked"},{"source":"EUVD","status":"not-checked"},{"source":"EPSS","status":"not-checked"}],"evidence":[],"aiSummary":{"text":"CGM CLININET stores user passwords as unsalted MD5 hashes, which is a weakness. This issue affects versions prior to 2026.MS1 and 2026.MS3. The impact is related to insufficient computational effort in password hashing.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-10-30T09:11:24.770Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2025-30049"}]}}