Threat reportVulnerabilityTL-2026-4237
Multiple vulnerabilities in CGM CLININET healthcare software (CVE-2025-30043 and 10 others)
Multiple vulnerabilities in CGM CLININET healthcare software (TL-2026-4237) is a high-severity software vulnerability, first published 2026-10-23. It has no confirmed attribution, affects CGM CGM CLININET, references 14 CVEs (CVE-2025-30043, CVE-2025-30045, CVE-2025-30046), maps to 7 MITRE ATT&CK techniques (T1059, T1078, T1110.002), and is covered by 9 detection rules and 8 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 14Referenced vulnerabilities
- Techniques
- 7MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 8Indicators of compromise
Key facts for TL-2026-4237
- Threat ID
- TL-2026-4237
- Severity
- HIGH
- Status
- MONITORING
- Category
- VULNERABILITY
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- health
- Target regions
- poland, Europe
- Detection rules
- 9
- Indicators of compromise
- 8
How Multiple vulnerabilities in CGM CLININET healthcare software works
CERT Polska disclosed 11 vulnerabilities in CGM CLININET hospital information software, including unauthenticated access to patient documents, several paths to root-level remote code execution (Perl code injection, Java deserialization, HL7 processes running as root), IP-spoofable rsyncd access, unsalted MD5 password storage and insecure credential files. Versions before 2026.MS3 or 2026.MS4 (depending on the CVE) are affected; some issues have no fixed version listed.
On 2026-10-23 CERT Polska published an advisory covering 11 CVEs in CGM CLININET, a healthcare information system. All were reported by Maciej Kazulak under CERT Polska coordinated vulnerability disclosure. The advisory gives no CVSS scores, no evidence of in-the-wild exploitation, no public PoC, no attribution and no network IOCs. The severity (HIGH) is an analyst assignment based on the described impact, not a source-stated rating.
Unauthenticated / network-reachable weaknesses: CVE-2025-30043 (CWE-306) - the /DocManagment endpoint lacks authentication, so an unauthenticated attacker on an adjacent network can list and download patient documents (fixed in 2026.MS3). CVE-2025-30053 (CWE-306) - the cgm-updater process listens on an open network port without any authentication (all versions through 2026.MS4, possibly later; no fixed version stated). CVE-2025-30052 (CWE-290) - rsyncd grants access based solely on the client source IP address, so a spoofed source address permits file editing (through 2026.MS4, possibly later).
Remote code execution / root-level impact: CVE-2025-30050 (CWE-94) - RunCGI.pm dynamically imports the module named in a query parameter and executes code from untrusted data, giving root-level code execution (fixed in 2026.MS3). CVE-2025-30047 (CWE-502) - the HTTP API deserializes Java objects, so crafted serialized objects sent from the local network yield arbitrary code execution as root (fixed in 2026.MS3). CVE-2025-30045 (CWE-94) - the ConvExpr function, which turns Perl expressions into RTF document content, lets an authenticated high-privileged user execute arbitrary code as root (fixed in 2026.MS4). CVE-2025-30046 (CWE-250) - several HL7 communication processes run as root while handling untrusted external data, enabling remote code execution from an adjacent network (through 2026.MS4, possibly later).
Credential and permission weaknesses: CVE-2025-30049 (CWE-916) - user passwords are stored as unsalted MD5 hashes (fixed in 2026.MS1 and 2026.MS3). CVE-2025-30051 (CWE-732) - SysIO.pl holds production database and RabbitMQ broker credentials with permissions that let any local account read them (fixed in 2026.MS3). CVE-2025-30054 (CWE-732) - files and scripts used by the root-running HL7 message processing service are modifiable by the uhcapache user, allowing local privilege escalation to root (fixed in 2026.MS4). CVE-2025-58403 is labeled Cross-site Scripting (CWE-79) with a fix in 2026.MS4, but the advisory text for it repeats the cgm-updater open-port wording used for CVE-2025-30053, so the exact XSS mechanism is unconfirmed. NVD had no records for the CVEs checked at research time.
This follows earlier CERT Polska advisories on CGM CLININET (August 2025 and March 2026) covering SQL injection, authentication bypass and RCE. Recommended actions from the source: upgrade to the fixed releases and apply network segmentation to healthcare systems.
MITRE ATT&CK techniques used in TL-2026-4237
Execution
T1059 Command and Scripting Interpreter
Initial Access
T1078 Valid Accounts; T1190 Exploit Public-Facing Application
Credential Access
T1110.002 Password Cracking; T1552.001 Credentials In Files
Collection
T1213 Data from Information Repositories
Impact
Affected products and versions in Multiple vulnerabilities in CGM CLININET healthcare software
- CGM — CGM CLININET
Vulnerable versions: All versions before 2026.MS3 (CVE-2025-30043, -30047, -30050, -30051, -30049); All versions before 2026.MS4 (CVE-2025-30045, -30054, -58403); All versions through 2026.MS4, possibly later (CVE-2025-30046, -30052, -30053)
Fixed in: 2026.MS1 (CVE-2025-30049); 2026.MS3; 2026.MS4
Remediation for Multiple vulnerabilities in CGM CLININET healthcare software
Patches
- Upgrade CGM CLININET to 2026.MS3 or later (CVE-2025-30043, -30047, -30049, -30050, -30051)
- Upgrade CGM CLININET to 2026.MS4 or later (CVE-2025-30045, -30054, -58403)
- CVE-2025-30049 is also fixed in 2026.MS1
Immediate actions
- Restrict network access to CGM CLININET hosts (HTTP API, /DocManagment, rsyncd, cgm-updater and HL7 ports) to required clinical segments only
- Rotate the database and RabbitMQ credentials stored in SysIO.pl and restrict the file to the service account
- Hunt for requests to /DocManagment and RunCGI.pm from unexpected sources, and for rsync connections from unexpected addresses
Workarounds
- CVE-2025-30046, -30052 and -30053 list no fixed version (all versions through 2026.MS4, possibly later); rely on network-level isolation and contact the vendor
- Block unauthenticated access to the affected endpoints and ports at an internal firewall or reverse proxy
Longer-term hardening
- Segment healthcare systems from general-purpose networks, as recommended by CERT Polska
- Run HL7 and updater services with least privilege instead of root
- Force a password reset for all users after upgrading, since passwords were stored as unsalted MD5 hashes
CVEs associated with Multiple vulnerabilities in CGM CLININET healthcare software
Weaknesses (CWE) in Multiple vulnerabilities in CGM CLININET healthcare software
CWE-306, CWE-94, CWE-250, CWE-502, CWE-916, CWE-732, CWE-290, CWE-79
Timeline of Multiple vulnerabilities in CGM CLININET healthcare software
- First CERT Polska batch covers 17 CGM CLININET CVEs (CVE-2025-2313 and CVE-2025-30036 to -30064 range) across code injection, SQL injection, missing authentication and XSS, with endpoints such as GetActiveSessions.pl, userlogxls.pl and the serverConfig endpoint
- CERT Polska publishes an earlier batch of CGM CLININET CVEs (e.g. CVE-2025-2313 RCE via Print.pl, multiple SQL injections and missing-authentication flaws)
- Second CERT Polska batch lists CVE-2025-30044 OS command injection via usrlogstat.pl, usrlogstat_simple.pl, userlogstat2.pl and dblogstat.pl, plus CVE-2025-30062 SQL injection in CheckUnitCodeAndKey.pl; fixes in CLININET 2025.MS2 to 2025.MS4 and CGM NETRAAD 7.9.0 (CVE-2025-10350)
- CERT Polska publishes a second batch of CGM CLININET CVEs (e.g. CVE-2025-30035 authentication bypass, CVE-2025-30044 RCE, CVE-2025-30062 SQL injection)
- Advisory states no CVSS scores, in-the-wild exploitation, PoC or attribution; it recommends upgrading and network segmentation of healthcare systems
- Release 2026.MS4 is named as the fix for CVE-2025-30045, -30054 and -58403; CVE-2025-30046, -30052 and -30053 remain without a stated fixed version
- Release 2026.MS3 is named as the fix for CVE-2025-30043, -30047, -30049, -30050 and -30051 (missing authentication on /DocManagment, Java deserialization, MD5 hashing, RunCGI.pm injection, SysIO.pl permissions)
- Advisory lists fixed releases 2026.MS3 and 2026.MS4 (2026.MS1 also for CVE-2025-30049); CVE-2025-30046, -30052 and -30053 list no fixed version
- CERT Polska publishes the advisory for CVE-2025-30043 and 10 other CGM CLININET vulnerabilities, all reported by Maciej Kazulak
Sources cited for Multiple vulnerabilities in CGM CLININET healthcare software
- CERT Polska - Vulnerabilities in CGM CLININET software
- CERT Polska - CVE-2025-2313 (earlier CGM CLININET advisory)
- CERT Polska - CVE-2025-10350 (earlier CGM CLININET advisory)
- CERT Polska Coordinated Vulnerability Disclosure policy
- CGM CLININET CVE listing (cve.imfht.com)
- GCVE record for CVE-2025-30035 (related CGM CLININET authentication bypass)
Detection coverage for TL-2026-4237
As of 2026-10-23, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4237 across Splunk SPL, Microsoft KQL and Sigma, covering 8 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.