CVE-2025-30039 CRITICAL

CVE-2025-30039: Missing authentication in API returning a list of all active sessions

Vendor Cgm

Product CGM CLININET

Weakness CWE-306 · Missing auth

Published August 27, 2025

Last update August 27, 2025

View on NVD All CVEs

CVSS base score

9.0/10

Attack vector Adjacent

Attack complexity Low

Privileges required None

User interaction None

Confidentiality —

Integrity —

CVSS vector

CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

What the vulnerability does

01Description

Unauthenticated access to the "/cgi-bin/CliniNET.prd/GetActiveSessions.pl" endpoint allows takeover of any user session logged into the system, including users with admin privileges.

Key dates

02Disclosure timeline

August 27, 2025 CVE published

August 27, 2025 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2025-30039 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/306.html

Related vulnerabilities

04Related CVE

CVE-2026-3558 Philips Hue Bridge HomeKit Accessory Protocol Transient Pairing Mode Authentication Bypass Vulnerability CVE-2023-21743 Microsoft SharePoint Server Security Feature Bypass Vulnerability CVE-2021-23843 Lack of authentication mechanisms on the device CVE-2023-5935 Missing authentication for local web interface in Arc before v1.6.0 CVE-2024-7726 Arbitrary Code execution via exposed JTAG port in Kioxia CM6, PM6, PM7