Insecure file permissions on the SysIO.pl configuration file allow any local account to read production database login credentials and RabbitMQ broker credentials stored in plain text, enabling the theft of administrative credentials for both the database and messaging system.

Vendor CGM, product CGM CLININET. The vulnerability applies to all releases prior to version 2026.MS3, which contains the fix.

The CVSS score of 6.8 indicates moderate severity; no EPSS data is available and the flaw is not listed in the CISA KEV catalog, suggesting no known public exploitation. The required attack vector is local access, meaning any user who can log into the system can read the file and obtain credentials, potentially leading to full system compromise if those credentials are used elsewhere.