The CGM CLININET application runs the cgm-updater process on an open network port with no authentication, creating a CWE-306 weakness. An attacker on the network can connect to this port without credentials and potentially issue commands, extract sensitive information, or manipulate the device. The lack of authentication directly undermines confidentiality, integrity, and availability of the clinical system.

CGM CLININET versions up to 2026.MS3, and potentially later releases, are affected. The vulnerability has been confirmed for all releases in that range; the exact scope of newer versions is not yet fully documented.

The CVSS score of 6.9 indicates moderate severity, and the EPSS score is not available. The vulnerability is not listed in the CISA KEV catalog. The attack vector is network, and the defect requires remote connection to the vulnerable port, which may be exposed in hospital or clinical networks. An attacker with network access can exploit the unauthenticated service to compromise the targeted device.