CGM CLININET: Local privilege escalation through incorrect file permissions
Summary
CGM CLININET, a hospital information system, runs the service that processes incoming HL7 messages with root privileges. Its scripts and configuration files have incorrect permissions, so the uhcapache account can modify them. An attacker with local access and uhcapache privileges can execute arbitrary code as root. No user interaction is required, but the attacker needs a local foothold first.
Affected
- CGM CLININET up to and including 2026.MS3 (per CVE record)
- Later versions may also be affected (not verified)
Fixed in
Unknown. The CERT Polska batch advisory names 2026.MS4 as the fixed version, but CGM has not confirmed this. Ask CGM for the advisory and the exact fixed build.
Workaround
Unknown. No vendor-confirmed workaround. Until patched:
- Verify that only root can modify the HL7 service scripts and configuration files; the uhcapache account must not have write access.
- Restrict and audit local logons to the CLININET server, including service accounts.
- Monitor the integrity of these files and alert on changes.
Exploitation
- No known exploitation (CISA SSVC: exploitation none, automatable no).
- No public proof of concept found.
- EPSS 0.001 (very low).
Our recommendation
- Check whether CGM CLININET is in use, for example at Swiss clinics or medical providers. If not, no action needed.
- Ask CGM for the vendor advisory and the fixed build, and apply it.
- Fix the file permissions and restrict local access now.
- Patch the whole CLININET batch (CVE-2025-30043 to CVE-2025-30054 and CVE-2025-58403), because sister CVEs in the adjacent network can provide the foothold.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CERT Polska: Vulnerabilities in CGM CLININET software cert.pl
- CGM CLININET product page www.cgm.com
- NVD record via Vulners vulners.com
- VulDB: CVE-2025-30054 vuldb.com
- HOL Guard: CVE-2025-30054 hol.org
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 00:50.
Original description (NVD)
CGM CLININET is vulnerable to local privilege escalation. The service that processes incoming HL7 messages runs with root privileges, but due to incorrect permissions, its scripts and configuration files can be modified by the uhcapache user. An attacker with uhcapache privileges can modify these files to execute arbitrary code as root. The vulnerability was confirmed to affect versions up to 2026.MS3 but later versions may also be vulnerable.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.