Remote Code Execution Vulnerability in CGM CLININET

CVE-2025-30047

What is CVE-2025-30047?

CGM CLININET is vulnerable to a Remote Code Execution flaw due to the deserialization of untrusted data. The issue arises from an HTTP-based API utilized by the administrative module that exchanges data through Java object serialization. An attacker on the same local network can exploit this vulnerability by sending specially crafted requests containing serialized objects. When these objects are deserialized by the server, it potentially allows the attacker to execute arbitrary code with root privileges. This critical issue has been addressed in CGM CLININET version 2026.MS3.

References