CGM CLININET: Code injection in ConvExpr function
Summary
CGM CLININET, a clinical information system, contains a code injection flaw in the ConvExpr function, which converts Perl expressions into RTF document content. An authenticated attacker with high privileges can cause arbitrary code to run with root privileges. CERT Polska reports that versions up to 2026.MS3 are affected and later versions may be too. Exploitation requires a valid high-privileged account, and no public exploit or exploitation has been reported.
Affected
- CGM CLININET, versions up to and including 2026.MS3
- Later versions may also be affected (not confirmed)
Fixed in
- Unknown. One source (CERT Polska) reportedly names 2026.MS4, but this is not confirmed by the vendor or the official CVE record. Confirm with CGM.
Workaround
- Unknown. No vendor workaround found.
- Restrict network access to the CLININET application server to necessary systems only.
- Review and limit accounts with high privileges.
Exploitation
- No public proof of concept found.
- Not listed as known exploited.
- CISA SSVC: Exploitation none, Automatable no, Technical Impact total.
Our recommendation
- Ask CGM to confirm the affected version in your installation and the release that fixes CVE-2025-30045.
- Plan the update to the fixed release, and include the other CVEs disclosed in the same batch (CVE-2025-30043, CVE-2025-30047, CVE-2025-30050, CVE-2025-30051).
- Until patched, restrict access to the application and review high-privileged accounts, and monitor for unusual activity on the server.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CERT Polska advisory: Vulnerabilities in CGM CLININET software cert.pl
- CGM CLININET product page www.cgm.com
- VulDB CVE-2025-30045 vuldb.com
- VulDB 425619 vuldb.com
- HOL Guard CVE-2025-30045 hol.org
- Safeguard blog on CGM CLININET batch safeguard.sh
- Strix CVE-2025-30045 www.strix.ai
- Vulners RAPID7 CVE-2025-30045 vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 07:13.
Original description (NVD)
CGM CLININET is vulnerable to Code Injection in the ConvExpr function, which processes Perl expressions into RTF document content. Due to improper control of the code evaluated from these expressions, an authenticated, high-privileged attacker can cause arbitrary code to be executed with root privileges. The vulnerability was confirmed to affect versions up to 2026.MS3 but later versions may also be vulnerable.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.