Report an incident
Back
  • About us
  • For experts
Report an incident
About us
About our team Contact
Baza wiedzy
Fałszywe inwestycje Bezpieczne zakupy w internecie (Nie)bezpieczne płatności Fałszywi konsultanci Zadbaj o bezpieczne hasła i logowanie Fałszywe załączniki w mailach Fałszywe testy CAPTCHA Fałszywe prośby o szybki przelew Bezpieczny telefon
Biuletyn OUCH!
Porady bezpieczeństwa OUCH!
Tools
n6 Artemis MWDB
CVD program
CVD policy Advisories

Vulnerabilities in CGM CLININET software
23 October 2026 | CERT Polska | #vulnerability, #warning, #cve
CVE ID CVE-2025-30043
Publication date 23 October 2026
Vendor CGM
Product CGM CLININET
Vulnerable versions All before 2026.MS3
Vulnerability type (CWE) Missing Authentication for Critical Function (CWE-306)
Report source Report to CERT Polska
CVE ID CVE-2025-30045
Publication date 23 October 2026
Vendor CGM
Product CGM CLININET
Vulnerable versions All through 2026.MS3
Vulnerability type (CWE) Improper Control of Generation of Code ('Code Injection') (CWE-94)
Report source Report to CERT Polska
CVE ID CVE-2025-30046
Publication date 23 October 2026
Vendor CGM
Product CGM CLININET
Vulnerable versions All through 2026.MS3
Vulnerability type (CWE) Execution with Unnecessary Privileges (CWE-250)
Report source Report to CERT Polska
CVE ID CVE-2025-30047
Publication date 23 October 2026
Vendor CGM
Product CGM CLININET
Vulnerable versions All before 2026.MS3
Vulnerability type (CWE) Deserialization of Untrusted Data (CWE-502)
Report source Report to CERT Polska
CVE ID CVE-2025-30049
Publication date 23 October 2026
Vendor CGM
Product CGM CLININET
Vulnerable versions All before 2026.MS1
All before 2026.MS3
Vulnerability type (CWE) Use of Password Hash With Insufficient Computational Effort (CWE-916)
Report source Report to CERT Polska
CVE ID CVE-2025-30050
Publication date 23 October 2026
Vendor CGM
Product CGM CLININET
Vulnerable versions All before 2026.MS3
Vulnerability type (CWE) Improper Control of Generation of Code ('Code Injection') (CWE-94)
Report source Report to CERT Polska
CVE ID CVE-2025-30051
Publication date 23 October 2026
Vendor CGM
Product CGM CLININET
Vulnerable versions All before 2026.MS3
Vulnerability type (CWE) Incorrect Permission Assignment for Critical Resource (CWE-732)
Report source Report to CERT Polska
CVE ID CVE-2025-30052
Publication date 23 October 2026
Vendor CGM
Product CGM CLININET
Vulnerable versions All through 2026.MS3
Vulnerability type (CWE) Authentication Bypass by Spoofing (CWE-290)
Report source Report to CERT Polska
CVE ID CVE-2025-30053
Publication date 23 October 2026
Vendor CGM
Product CGM CLININET
Vulnerable versions All through 2026.MS3
Vulnerability type (CWE) Missing Authentication for Critical Function (CWE-306)
Report source Report to CERT Polska
CVE ID CVE-2025-30054
Publication date 23 October 2026
Vendor CGM
Product CGM CLININET
Vulnerable versions All through 2026.MS3
Vulnerability type (CWE) Incorrect Permission Assignment for Critical Resource (CWE-732)
Report source Report to CERT Polska
CVE ID CVE-2025-58403
Publication date 23 October 2026
Vendor CGM
Product CGM CLININET
Vulnerable versions All through 2026.MS3
Vulnerability type (CWE) Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
Report source Report to CERT Polska

Description

CERT Polska has received a report about vulnerabilities in CGM CLININET software and participated in coordination of their disclosure.

The vulnerability CVE-2025-30043: CGM CLININET is vulnerable to Missing Authentication for Critical Function in the /DocManagment path. The endpoint is accessible without authentication, allowing an unauthenticated attacker in the adjacent network to retrieve the list of patient documents and download those documents. This issue was fixed in version 2026.MS3

The vulnerability CVE-2025-30045: CGM CLININET is vulnerable to Code Injection in the ConvExpr function, which processes Perl expressions into RTF document content. Due to improper control of the code evaluated from these expressions, an authenticated, high-privileged attacker can cause arbitrary code to be executed with root privileges. The vulnerability was confirmed to affect versions up to 2026.MS3 but later versions may also be vulnerable.

The vulnerability CVE-2025-30046: In the CGM CLININET application server, multiple processes responsible for HL7 communication with external systems run with root privileges while processing untrusted data received from those external systems. An attacker in adjacent network able to send data to these HL7 communication processes can achieve remote code execution with root privileges. The vulnerability was confirmed to affect versions up to 2026.MS3 but later versions may also be vulnerable.

The vulnerability CVE-2025-30047: CGM CLININET is vulnerable to Remote Code Execution caused by deserialization of untrusted data. The server exposes an HTTP-based API, used by the administrative module, that exchanges data using Java object serialization. An attacker within the same local network is able to send requests to this API and transmit a crafted serialized object. When it is deserialized, it allows arbitrary code execution with root privileges on the server. This issue was fixed in version 2026.MS3

The vulnerability CVE-2025-30049: The CGM CLININET application stores user passwords as unsalted MD5 hashes. This issue was fixed in versions 2026.MS1 and 2026.MS3

The vulnerability CVE-2025-30050: CGM CLININET is vulnerable to Code Injection in the RunCGI.pm component, which dynamically imports the module specified as a query parameter and executes code from untrusted data provided by the user. An attacker from adjacent network can supply a crafted query parameter to have an attacker-controlled module imported which results in arbitrary code execution with root privileges. This issue was fixed in version 2026.MS3

The vulnerability CVE-2025-30051: The CGM CLININET application stores the production database login and password, as well as RabbitMQ broker credentials, in the SysIO.pl configuration file. Insecure file permissions make this file readable by any local account. This issue was fixed in version 2026.MS3

The vulnerability CVE-2025-30052: The rsyncd service of the CGM CLININET is vulnerable to Authentication Bypass via IP spoofing. Access is granted based solely on the client's source IP address. An attacker able to spoof an allowed IP address, can bypass this check and gain the ability to edit files on the affected system. The vulnerability was confirmed to affect versions up to 2026.MS3 but later versions may also be vulnerable.

The vulnerability CVE-2025-30053: The CGM CLININET application runs the cgm-updater process listening on an open network port without any authentication. The vulnerability was confirmed to affect versions up to 2026.MS3 but later versions may also be vulnerable.

The vulnerability CVE-2025-30054: CGM CLININET is vulnerable to local privilege escalation. The service that processes incoming HL7 messages runs with root privileges, but due to incorrect permissions, its scripts and configuration files can be modified by the uhcapache user. An attacker with uhcapache privileges can modify these files to execute arbitrary code as root. The vulnerability was confirmed to affect versions up to 2026.MS3 but later versions may also be vulnerable.

The vulnerability CVE-2025-58403: The CGM CLININET application runs the cgm-updater process listening on an open network port without any authentication. The vulnerability was confirmed to affect versions up to 2026.MS3 but later versions may also be vulnerable.

Credits

We thank Maciej Kazulak for the responsible report of CVE-2025-30043, from CVE-2025-30045 to CVE-2025-30047 and from CVE-2025-30049 to CVE-2025-30054 vulnerabilities.

More about the coordinated vulnerability disclosure process at CERT Polska can be found at https://cert.pl/en/cvd/.