The CGM CLININET application runs a cgm-updater process that listens on an open network port without requiring authentication, creating a CWE‑306 weakness. This means any actor that can reach the port can connect to the updater service without credentials, potentially exposing the device to unauthorized access and jeopardizing the confidentiality, integrity, or availability of the medical system. This concern is based directly on the stated lack of authentication; further specific capabilities of the updater are not disclosed in the CVE description, so the potential impact is limited to the possibilities inherent in an unauthenticated network service.

CGM CLININET versions up to 2026.MS3 are affected, except when the device includes the updater‑upkg component version 5.3.0 or newer. The version 2026.MS3 with the protected component is not vulnerable, while all earlier releases lacking that protection remain at risk.

The CVSS score of 6.9 indicates moderate severity, and the EPSS score of less than 1% suggests a low likelihood of exploitation at the present time. The vulnerability is not listed in the CISA KEV catalog. Attackers would need network access to the open port, so the attack vector is network‑based. The primary weakness is missing authentication; exploitation would rely on connecting to the service and using any commands or controls it exposes, if any. Given the moderate score and low EPSS, the overall risk is moderate but should not be ignored in clinical environments.