CVE-2025-30050 PUBLISHED

Remote Code Execution in CGM CLININET

Assigner: CERT-PL
Reserved: 14.03.2025 Published: 23.10.2026 Updated: 23.10.2026

CGM CLININET is vulnerable to Code Injection in the RunCGI.pm component, which dynamically imports the module specified as a query parameter and executes code from untrusted data provided by the user. An attacker from adjacent network can supply a crafted query parameter to have an attacker-controlled module imported which results in arbitrary code execution with root privileges.

This issue was fixed in version 2026.MS3

Metrics

CVSS 4.0

CVSS Vector: CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
CVSS Score: 9.4

Exploitability Metrics		Vulnerable System Impact Metrics		Subsequent System Impact Metrics
Attack Vector	Adjacent	Confidentiality	High	Confidentiality	High
Attack Complexity	Low	Integrity	High	Integrity	High
Attack Requirements	None	Availability	High	Availability	High
Privileges Required	None
User Interaction	None

CVSS 4.0

Product Status

Vendor	CGM
Product	CGM CLININET
Versions	Default: unaffected affected from 0 to 2026.MS3 (excl.)

References

Problem Types

CWE-94 Improper Control of Generation of Code ('Code Injection') CWE