CVE-2025-30047

CriticalCVSS 9.4/10Last modified Oct 23, 2026

Description

CGM CLININET is vulnerable to Remote Code Execution caused by deserialization of untrusted data. The server exposes an HTTP-based API, used by the administrative module, that exchanges data using Java object serialization. An attacker within the same local network is able to send requests to this API and transmit a crafted serialized object. When it is deserialized, it allows arbitrary code execution with root privileges on the server.

This issue was fixed in version 2026.MS3

Metrics

CVSS 4.0 9.4/10

CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-502

Affected software

No affected versions have been published.

Timeline

Published: Oct 23, 2026
Last modified: Oct 23, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-300485.3The "serverConfig" endpoint, which returns the module configuration including credentials, is accessible without authentication.CVE-2025-300498.2The CGM CLININET application stores user passwords as unsalted MD5 hashes. This issue was fixed in versions 2026.MS1 and 2026.MS3 CVE-2025-30055.4A vulnerability was found in Sayski ForestBlog up to 20250321 and classified as problematic. Affected by this issue is some unknown function CVE-2025-300509.4CGM CLININET is vulnerable to Code Injection in the RunCGI.pm component, which dynamically imports the module specified as a query parameter CVE-2025-300516.8The CGM CLININET application stores the production database login and password, as well as RabbitMQ broker credentials, in the SysIO.pl conf CVE-2025-300528.8The rsyncd service of the CGM CLININET is vulnerable to Authentication Bypass via IP spoofing. Access is granted based solely on the client'CVE-2025-300536.9The CGM CLININET application runs the cgm-updater process listening on an open network port without any authentication. The vulnerabilit CVE-2025-300549.3CGM CLININET is vulnerable to local privilege escalation. The service that processes incoming HL7 messages runs with root privileges, but du CVE-2025-300559.0The "system" function receives untrusted input from the user. If the "EnableJSCaching" option is enabled, it is possible to execute arbitrar CVE-2025-300569.4The RunCommand function accepts any parameter, which is then passed for execution in the shell. This allows an attacker to execute arbitrary CVE-2025-300579.4In UHCRTFDoc, the filename parameter can be exploited to execute arbitrary code via command injection into the system() call in the ConvertT CVE-2025-300586.9In the PatientService.pl service, the "getPatientIdentifier" function is vulnerable to SQL injection through the "pesel" parameter.