CGM CLININET: Remote code execution via Java deserialization in admin API
Summary
CGM CLININET, a hospital information system, exposes an HTTP-based administrative API that deserializes Java objects from untrusted input. An attacker on the same local network can send a crafted serialized object and execute arbitrary code with root privileges on the server. No credentials or user interaction are required according to the CVSS vector, and the impact includes confidentiality, integrity and availability.
Affected
- CGM CLININET, all versions before 2026.MS3 (per CERT Polska)
- Some sources (VulDB) describe the range as up to 2026.MS2; confirm the exact range with CGM.
Fixed in
- Fixed in CGM CLININET 2026.MS3 (per CERT Polska)
- Confirm the installed build with CGM before rollout. No CGM-specific advisory found.
Workaround
- Unknown. No vendor workaround found.
- Until patched, restrict network access to the CLININET server and its administrative API to required hosts only.
- Segment the clinic network so that workstations and guest devices cannot reach the server.
Exploitation
- Known exploited: no (per available sources).
- Public exploit: none known (VulDB states no available exploit).
- CISA SSVC: exploitation none, automatable no, technical impact total.
Our recommendation
- Check whether CGM CLININET is in use; if not, this CVE does not apply.
- Verify the installed build and update to 2026.MS3 or later with the vendor.
- Isolate the server from untrusted network segments until patched.
- Review the other CVEs in the same CERT Polska advisory for the same server (CVE-2025-30043, CVE-2025-30051).
- Monitor the server and the administrative API for unusual requests.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CERT Polska: Vulnerabilities in CGM CLININET software cert.pl
- CGM CLININET product page www.cgm.com
- VulDB CVE-2025-30047 vuldb.com
- VulDB vulnerability 425618 vuldb.com
- HOL Guard CVE-2025-30047 hol.org
- Strix CVE-2025-30047 www.strix.ai
- Safeguard.sh analysis CVE-2025-30047 safeguard.sh
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 23:52.
Original description (NVD)
CGM CLININET is vulnerable to Remote Code Execution caused by deserialization of untrusted data. The server exposes an HTTP-based API, used by the administrative module, that exchanges data using Java object serialization. An attacker within the same local network is able to send requests to this API and transmit a crafted serialized object. When it is deserialized, it allows arbitrary code execution with root privileges on the server. This issue was fixed in version 2026.MS3
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.