SQL Injection Vulnerability in CGM NETRAAD's Imageserver Module
CVE-2025-10350

8.8HIGH

Key Information:

Vendor

Cgm

Status
Cgm Netraad
Vendor
CVE Published:
2 March 2026

What is CVE-2025-10350?

A SQL Injection vulnerability exists in the imageserver module of CGM NETRAAD, specifically affecting the handling of C-FIND queries. This flaw permits an attacker with access to the PACS system to exploit the vulnerability, potentially enabling unauthorized access to the database, and compromising sensitive data processed by the integrated GCM CLININET software. This issue is present in versions prior to 7.9.0, making it critical for users to update their systems to safeguard against potential exploitation.

Affected Version(s)

CGM NETRAAD 0

References

https://cert.pl/en/posts/2026/03/CVE-2025-10350/
third-party-advisory
https://www.cgm.com/pol_pl/products/szpital/cgm-netraad.html
product

CVSS V4

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
Low
Attack Vector:
Adjacent Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Maciej Kazulak
.