CVE-2025-30046

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-30046", "assignerOrgId": "4bb8329e-dd38-46c1-aafb-9bf32bcb93c6", "state": "PUBLISHED", "assignerShortName": "CERT-PL", "dateReserved": "2025-03-14T14:55:05.983Z", "datePublished": "2026-10-23T08:22:55.246Z", "dateUpdated": "2026-10-28T20:03:37.137Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "4bb8329e-dd38-46c1-aafb-9bf32bcb93c6", "shortName": "CERT-PL", "dateUpdated": "2026-10-23T08:22:55.246Z"}, "title": "Remote Code Execution in CGM CLININET", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-250", "description": "CWE-250 Execution with Unnecessary Privileges", "type": "CWE"}]}], "affected": [{"vendor": "CGM", "product": "CGM CLININET", "modules": ["HL7 communication"], "versions": [{"status": "affected", "version": "0", "lessThanOrEqual": "2026.MS3", "versionType": "custom"}], "defaultStatus": "unknown"}], "cpeApplicability": [{"operator": "OR", "nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:cgm:cgm_clininet:*:*:*:*:*:*:*:*", "versionStartIncluding": "0", "versionEndIncluding": "2026.ms4"}]}]}], "descriptions": [{"lang": "en", "value": "In the CGM CLININET application server, multiple processes responsible for HL7 communication with external systems run with root privileges while processing untrusted data received from those external systems. An attacker\u00a0in adjacent network able to send data to these HL7 communication processes can achieve remote code execution with root privileges.\u00a0\n\n\nThe vulnerability was confirmed to affect versions up to\u00a02026.MS3 but later versions may also be vulnerable.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "In the CGM CLININET application server, multiple processes responsible for HL7 communication with external systems run with root privileges while processing untrusted data received from those external systems. An attacker&nbsp;in adjacent network able to send data to these HL7 communication processes can achieve remote code execution with root privileges.&nbsp;<div><br></div><div>The vulnerability was confirmed to affect versions up to&nbsp;2026.MS3 but later versions may also be vulnerable.</div>"}]}], "references": [{"url": "https://cert.pl/en/posts/2026/10/CVE-2025-30043/", "tags": ["third-party-advisory"]}, {"url": "https://www.cgm.com/pol_pl/products/szpital/cgm-clininet.html", "tags": ["product"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "ADJACENT", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "subIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "subAvailabilityImpact": "HIGH", "exploitMaturity": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "CRITICAL", "baseScore": 9, "vectorString": "CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H"}}], "source": {"discovery": "EXTERNAL"}, "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-10-28T17:53:26.311077Z", "id": "CVE-2025-30046", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-28T20:03:37.137Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-30046", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-28T17:53:26.311077Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-28T17:53:28.443Z"}}], "cna": {"title": "Remote Code Execution in CGM CLININET", "source": {"discovery": "EXTERNAL"}, "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 9, "Automatable": "NOT_DEFINED", "attackVector": "ADJACENT", "baseSeverity": "CRITICAL", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "CGM", "modules": ["HL7 communication"], "product": "CGM CLININET", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "2026.MS3"}], "defaultStatus": "unknown"}], "references": [{"url": "https://cert.pl/en/posts/2026/10/CVE-2025-30043/", "tags": ["third-party-advisory"]}, {"url": "https://www.cgm.com/pol_pl/products/szpital/cgm-clininet.html", "tags": ["product"]}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "In the CGM CLININET application server, multiple processes responsible for HL7 communication with external systems run with root privileges while processing untrusted data received from those external systems. An attacker\u00a0in adjacent network able to send data to these HL7 communication processes can achieve remote code execution with root privileges.\u00a0\n\n\nThe vulnerability was confirmed to affect versions up to\u00a02026.MS3 but later versions may also be vulnerable.", "supportingMedia": [{"type": "text/html", "value": "In the CGM CLININET application server, multiple processes responsible for HL7 communication with external systems run with root privileges while processing untrusted data received from those external systems. An attacker&nbsp;in adjacent network able to send data to these HL7 communication processes can achieve remote code execution with root privileges.&nbsp;<div><br></div><div>The vulnerability was confirmed to affect versions up to&nbsp;2026.MS3 but later versions may also be vulnerable.</div>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-250", "description": "CWE-250 Execution with Unnecessary Privileges"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:cgm:cgm_clininet:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndIncluding": "2026.ms4", "versionStartIncluding": "0"}], "operator": "OR"}], "operator": "OR"}], "providerMetadata": {"orgId": "4bb8329e-dd38-46c1-aafb-9bf32bcb93c6", "shortName": "CERT-PL", "dateUpdated": "2026-10-23T08:22:55.246Z"}}}, "cveMetadata": {"cveId": "CVE-2025-30046", "state": "PUBLISHED", "dateUpdated": "2026-10-28T20:03:37.137Z", "dateReserved": "2025-03-14T14:55:05.983Z", "assignerOrgId": "4bb8329e-dd38-46c1-aafb-9bf32bcb93c6", "datePublished": "2026-10-23T08:22:55.246Z", "assignerShortName": "CERT-PL"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unknown", "modules": ["HL7 communication"], "product": "CGM CLININET", "vendor": "CGM", "versions": [{"lessThanOrEqual": "2026.MS3", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "cvd@cert.pl"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the CGM CLININET application server, multiple processes responsible for HL7 communication with external systems run with root privileges while processing untrusted data received from those external systems. An attacker\u00a0in adjacent network able to send data to these HL7 communication processes can achieve remote code execution with root privileges.\u00a0\n\n\nThe vulnerability was confirmed to affect versions up to\u00a02026.MS3 but later versions may also be vulnerable."}, {"lang": "es", "value": "En el servidor de aplicaciones CGM CLININET, varios procesos responsables de la comunicaci\u00f3n HL7 con sistemas externos se ejecutan con privilegios de root mientras procesan datos no confiables recibidos de esos sistemas externos. Un atacante en una red adyacente que pueda enviar datos a estos procesos de comunicaci\u00f3n HL7 puede lograr una ejecuci\u00f3n remota de c\u00f3digo (RCE) con privilegios de root.\\n\\nSe confirm\u00f3 que la vulnerabilidad afecta hasta la versi\u00f3n 2026.MS3 incluida, aunque versiones posteriores tambi\u00e9n podr\u00edan ser vulnerables."}], "id": "CVE-2025-30046", "lastModified": "2026-10-28T20:17:15.810", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "ADJACENT", "availabilityRequirement": "NOT_DEFINED", "baseScore": 9.0, "baseSeverity": "CRITICAL", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cvd@cert.pl", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-30046", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-10-28T17:53:26.311077Z", "version": "2.0.3"}}]}, "published": "2026-10-23T09:17:04.450", "references": [{"source": "cvd@cert.pl", "url": "https://cert.pl/en/posts/2026/10/CVE-2025-30043/"}, {"source": "cvd@cert.pl", "url": "https://www.cgm.com/pol_pl/products/szpital/cgm-clininet.html"}], "sourceIdentifier": "cvd@cert.pl", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-250"}], "source": "cvd@cert.pl", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,2026.MS3]"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "CGM CLININET", "source": "cna", "vendor": "CGM"}, "product": "cgm_clininet", "vendor": "cgm"}], "created": "2026-10-23T09:15:14.293114+00:00", "updated": "2026-10-23T10:00:15.990901+00:00", "vendors": ["cgm", "cgm$PRODUCT$cgm_clininet"]}