CVE-2025-30049

Use of Unsalted MD5 Password Hashes in CGM CLININET

State: Published
Severity: 8.2 High
Published: Oct 23, 2026
Updated: Oct 28, 2026
Reserved: Mar 14, 2025

Description

The CGM CLININET application stores user passwords as unsalted MD5 hashes.

This issue was fixed in versions 2026.MS1 and 2026.MS3

Scores

CVSS	Score	Vector	Source
4.0	8.2 High	CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N	CERT-PL

Weaknesses

CWE-916 Use of Password Hash With Insufficient Computational Effort

Affected Products

Product	Versions
CGM CLININETCGM	before 2026.MS1Affected before 2026.MS3Affected

References

https://cert.pl/en/posts/2026/10/CVE-2025-30043/third-party-advisory
https://www.cgm.com/pol_pl/products/szpital/cgm-clininet.htmlproduct

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.