---
cve: "CVE-2025-30052"
severity: "HIGH"
cvss: 8.8
epss: "0.3%"
vendor: "CGM"
kev: false
exploited: false
published: "2026-10-23 09:17:05"
tags: [cve, security, high]
source: tsecurity.de CVE-Dossier
exported: "2026-11-02T05:52:49+01:00"
---

# CVE-2025-30052

> 8.8 HIGH

## Beschreibung

The rsyncd service of the CGM CLININET is vulnerable to Authentication Bypass via IP spoofing. Access is granted based solely on the client's source IP address. An attacker able to spoof an allowed IP address, can bypass this check and gain the ability to edit files on the affected system. 


The vulnerability was confirmed to affect versions up to 2026.MS3 but later versions may also be vulnerable.

## CNA-Record (Kanon, cvelistV5)

- CNA: **CERT-PL**
- State: PUBLISHED
- Stand: 2026-10-28 20:02:59
- CNA-CVSS: **8.8** (`CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:L/SA:N`)

## CISA-Anreicherung (vulnrichment/ADP)

- CISA-SSVC (Coordinator, v2.0.3):
  - Exploitation: **none**
  - Automatable: **yes**
  - Technical Impact: **partial**

## CVSS-Vektor

```
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:L/SA:N
```

| Metrik | Wert | Bewertung |
|---|---|---|
| AV Angriffsvektor | Netzwerk | bad |
| AC Komplexität | Gering | bad |
| PR Privilegien | Keine | bad |
| UI Interaktion | Keine | bad |

## Schwachstellen-Klasse

- **CWE-290** — Authentication Bypass by Spoofing
  This attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks.

## Angriffsmuster (CAPEC)

- [CAPEC-21 — Exploitation of Trusted Identifiers](https://capec.mitre.org/data/definitions/21.html) _(Severity: High)_
- [CAPEC-22 — Exploiting Trust in Client](https://capec.mitre.org/data/definitions/22.html) _(Severity: High)_
- [CAPEC-59 — Session Credential Falsification through Prediction](https://capec.mitre.org/data/definitions/59.html) _(Severity: High)_
- [CAPEC-60 — Reusing Session IDs (aka Session Replay)](https://capec.mitre.org/data/definitions/60.html) _(Severity: High)_
- [CAPEC-459 — Creating a Rogue Certification Authority Certificate](https://capec.mitre.org/data/definitions/459.html) _(Severity: Very High)_
- [CAPEC-461 — Web Services API Signature Forgery Leveraging Hash Function Extension Weakness](https://capec.mitre.org/data/definitions/461.html) _(Severity: High)_
- [CAPEC-473 — Signature Spoof](https://capec.mitre.org/data/definitions/473.html)
- [CAPEC-476 — Signature Spoofing by Misrepresentation](https://capec.mitre.org/data/definitions/476.html) _(Severity: High)_

## ATT&CK-Techniken

- [T1134 — Access Token Manipulation](https://attack.mitre.org/techniques/T1134/)
- [T1528 — Steal Application Access Token](https://attack.mitre.org/techniques/T1528/)
- [T1539 — Steal Web Session Cookie](https://attack.mitre.org/techniques/T1539/)
- [T1134.001 — Access Token Manipulation:Token Impersonation/Theft](https://attack.mitre.org/techniques/T1134/001/)
- [T1550.004 — Use Alternate Authentication Material:Web Session Cookie](https://attack.mitre.org/techniques/T1550/004/)
- [T1036.001 — Masquerading: Invalid Code Signature](https://attack.mitre.org/techniques/T1036/001/)
- [T1553.002 — Subvert Trust Controls: Code Signing](https://attack.mitre.org/techniques/T1553/002/)

## Referenzen

- <https://cert.pl/en/posts/2026/10/CVE-2025-30043/>
- <https://www.cgm.com/pol_pl/products/szpital/cgm-clininet.html>

---
_Exportiert aus dem [tsecurity.de CVE-Dossier](https://tsecurity.de/sicherheitsluecken/cve-2025-30052/) · Datenquellen: EUVD (ENISA), NVD, OSV, CISA KEV, FIRST EPSS, Exploit-DB, BSI WID (CSAF)_