CVE-2025-30052 in CLININET
Summary
by MITRE • 10/23/2026
The rsyncd service of the CGM CLININET is vulnerable to Authentication Bypass via IP spoofing. Access is granted based solely on the client's source IP address. An attacker able to spoof an allowed IP address, can bypass this check and gain the ability to edit files on the affected system.
The vulnerability was confirmed to affect versions up to 2026.MS3 but later versions may also be vulnerable.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/23/2026
CGM CLININET is a specialized software solution designed for clinical laboratory information management, facilitating the processing and storage of patient data within healthcare environments. The rsyncd service integrated into this system serves as a mechanism for file synchronization and transfer, often utilized for backing up critical database files or distributing configuration updates across networked systems. In many legacy or embedded implementations of such services, security configurations are frequently simplified to prioritize ease of deployment over robust access control. This specific vulnerability arises from the fundamental design flaw where authentication is not performed through cryptographic credentials but relies exclusively on IP-based filtering rules. The service operates under the assumption that any connection originating from an address listed in its allowlist is inherently trustworthy and authorized for administrative actions, including file modification operations.
The technical core of this vulnerability lies in the lack of source IP verification integrity checks when processing incoming connections via rsyncd. Internet Protocol (IP) packets contain a header field specifying the source address, which can be easily forged by an attacker on the same local network segment or through more complex routing exploits if internal segmentation is weak. By crafting custom network packets with a spoofed source IP that matches one of the permitted addresses defined in the rsyncd configuration file, an adversary can bypass the access control list entirely. Since the service does not validate the actual origin of the packet against any secondary authentication mechanism such as password-based login or certificate exchange, it accepts the connection and grants the attacker full write permissions to the targeted directories. This represents a classic case where network-level trust is incorrectly equated with application-level authorization.
The operational impact of this vulnerability is severe within the context of clinical data management systems. An attacker who successfully exploits this flaw can modify, delete, or inject malicious files into the system's file structure. In a laboratory information system, rsync often handles sensitive patient records, test results, and configuration settings that dictate how diagnostic equipment operates. Unauthorized modification of these files could lead to data integrity issues, where lab results are altered to hide medical conditions or fabricate diagnoses, posing direct risks to patient safety. Furthermore, the ability to edit system files allows for the persistence of malicious code, potentially leading to a complete compromise of the host machine and subsequent lateral movement within the hospital network. The vulnerability affects versions up to 2026.MS3, though later iterations may remain susceptible if the underlying architectural decision to rely on IP whitelisting without additional authentication layers persists in newer releases.
From a classification perspective, this flaw aligns with CWE-287 Improper Authentication and CWE-918 Server-Side Request Forgery (SSRF) variants where trust is placed solely on network attributes rather than identity verification. It also maps to the MITRE ATT&CK technique T1049 System Network Discovery or more accurately T1530 Data from Information Repositories if used for exfiltration, but primarily represents an initial access vector via T1078 Valid Accounts when considering that spoofed IPs effectively act as valid credentials in this broken model. To mitigate this risk, immediate remediation should involve disabling the rsyncd service unless absolutely necessary for operational continuity. If the service must remain active, it is imperative to implement strong authentication mechanisms such as password-based or key-based verification supported by rsync's built-in auth options. Additionally, network segmentation strategies like firewalls and intrusion detection systems should be configured to restrict access to only known management interfaces, although these are secondary controls since they can also be bypassed via IP spoofing if not combined with deeper packet inspection techniques that validate TCP sequence numbers or use stateful tracking more rigorously.