CGM CLININET: Code injection in RunCGI.pm allows remote code execution as root
Summary
CGM CLININET, a hospital information system, contains a code injection flaw in the RunCGI.pm component. The component dynamically imports a Perl module named in a query parameter and executes code from that untrusted input. An attacker on the adjacent network can supply a crafted parameter and execute arbitrary code with root privileges on the server.
Affected
- CGM CLININET versions before 2026.MS3 (according to CERT Polska)
- Some sources describe the scope as up to 2026.MS2, which matches the same boundary
- Remote reachability is disputed: the CVE record says adjacent network, VulDB describes remote exploitation
Fixed in
- Version 2026.MS3
Workaround
- Restrict network access to the CLININET server to authorised management stations and clinical workstations (VulDB guidance, not a vendor statement)
- Unknown whether further vendor mitigations exist
Exploitation
- Not known to be exploited in the wild; not listed in CISA KEV according to the sources checked
- VulDB states no exploit exists; no public proof-of-concept found
- Vendor or CERT statements on exploitation: Unknown.
Our recommendation
- If CLININET is in use, upgrade to version 2026.MS3 as a priority, together with the sibling fixes in the same release (CVE-2025-30043, -30047, -30051)
- Until the upgrade is done, limit access to the CLININET server to required management and clinical systems and verify the actual network reachability
- Monitor the server for unexpected processes and file changes running as root
- Confirm the fix with the vendor, as no separate CGM advisory document was found
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CERT Polska: Vulnerabilities in CGM CLININET software cert.pl
- CGM CLININET product page www.cgm.com
- VulDB CVE-2025-30050 vuldb.com
- VulDB vulnerability 425622 vuldb.com
- Strix CVE-2025-30050 www.strix.ai
- Vulners Rapid7 CVE-2025-30050 vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 23:53.
Original description (NVD)
CGM CLININET is vulnerable to Code Injection in the RunCGI.pm component, which dynamically imports the module specified as a query parameter and executes code from untrusted data provided by the user. An attacker from adjacent network can supply a crafted query parameter to have an attacker-controlled module imported which results in arbitrary code execution with root privileges. This issue was fixed in version 2026.MS3
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.