Remote Code Execution Risk in CGM CLININET Application Server
CVE-2025-30046

9CRITICAL

Key Information:

Vendor

Cgm

Status
Cgm Clininet
Vendor
CVE Published:
23 October 2026

What is CVE-2025-30046?

The CGM CLININET application server contains a vulnerability where multiple processes handling HL7 communication with external systems operate with root privileges while processing untrusted data. This allows an attacker from an adjacent network to exploit the HL7 communication processes, potentially leading to remote code execution with root access. Affected versions include CGM CLININET up to and including 2026.MS3, with the possibility that later versions may also be susceptible.

Affected Version(s)

CGM CLININET 0 <= 2026.MS3

References

https://cert.pl/en/posts/2026/10/CVE-2025-30043/
third-party-advisory
https://www.cgm.com/pol_pl/products/szpital/cgm-clininet....
product

CVSS V4

Score:
9
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Adjacent Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.