CVE-2025-30050

CGM CLININET is vulnerable to Code Injection in the RunCGI.pm component, which dynamically imports the module specified as a query parameter and executes code from untrusted data provided by the user. An attacker from adjacent network can supply a crafted query parameter to have an attacker-controlled module imported which results in arbitrary code execution with root privileges. This issue was fixed in version 2026.MS3

CVSS

No CVSS.

References

Link	Resource
https://cert.pl/en/posts/2026/10/CVE-2025-30043/
https://www.cgm.com/pol_pl/products/szpital/cgm-clininet.html

Configurations

No configuration.

History

28 Oct 2026, 14:10

Type	Values Removed	Values Added
Summary		(es) CGM CLININET es vulnerable a inyección de código en el componente RunCGI.pm, que importa dinámicamente el módulo especificado como parámetro de consulta y ejecuta código proveniente de datos no confiables proporcionados por el usuario. Un atacante de una red adyacente puede suministrar un parámetro de consulta manipulado para que se importe un módulo controlado por el atacante, lo que resulta en ejecución de código arbitrario con privilegios de root.\n\nEste problema se solucionó en la versión 2026.MS3.

23 Oct 2026, 09:17

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-10-23 09:17

Updated : 2026-10-28 20:17

NVD link : CVE-2025-30050

Mitre link : CVE-2025-30050

CVE.ORG link : CVE-2025-30050

JSON object : View

Products Affected

No product.

CWE

CWE-94

Improper Control of Generation of Code ('Code Injection')

{"id": "CVE-2025-30050", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-30050", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-10-28T17:53:31.920810Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "cvd@cert.pl", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 9.4, "Automatable": "NOT_DEFINED", "attackVector": "ADJACENT", "baseSeverity": "CRITICAL", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "cvd@cert.pl", "affectedData": [{"vendor": "CGM", "modules": ["RunCGI.pm"], "product": "CGM CLININET", "versions": [{"status": "affected", "version": "0", "lessThan": "2026.MS3", "versionType": "custom"}], "programFiles": ["RunCGI.pm"], "defaultStatus": "unaffected"}]}], "published": "2026-10-23T09:17:04.810", "references": [{"url": "https://cert.pl/en/posts/2026/10/CVE-2025-30043/", "source": "cvd@cert.pl"}, {"url": "https://www.cgm.com/pol_pl/products/szpital/cgm-clininet.html", "source": "cvd@cert.pl"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "cvd@cert.pl", "description": [{"lang": "en", "value": "CWE-94"}]}], "descriptions": [{"lang": "en", "value": "CGM CLININET is vulnerable to Code Injection in the RunCGI.pm component, which dynamically imports the module specified as a query parameter and executes code from untrusted data provided by the user. An attacker from adjacent network can supply a crafted query parameter to have an attacker-controlled module imported which results in arbitrary code execution with root privileges.\n\n\nThis issue was fixed in version 2026.MS3"}, {"lang": "es", "value": "CGM CLININET es vulnerable a inyecci\u00f3n de c\u00f3digo en el componente RunCGI.pm, que importa din\u00e1micamente el m\u00f3dulo especificado como par\u00e1metro de consulta y ejecuta c\u00f3digo proveniente de datos no confiables proporcionados por el usuario. Un atacante de una red adyacente puede suministrar un par\u00e1metro de consulta manipulado para que se importe un m\u00f3dulo controlado por el atacante, lo que resulta en ejecuci\u00f3n de c\u00f3digo arbitrario con privilegios de root.\\n\\nEste problema se solucion\u00f3 en la versi\u00f3n 2026.MS3."}], "lastModified": "2026-10-28T20:17:16.140", "sourceIdentifier": "cvd@cert.pl"}