# Multiple vulnerabilities in CGM CLININET healthcare software (CVE-2025-30043 and 10 others)

> CERT Polska disclosed 11 vulnerabilities in CGM CLININET hospital information software, including unauthenticated access to patient documents, several paths to root-level remote code execution (Perl code injection, Java deserialization, HL7 processes running as root), IP-spoofable rsyncd access, unsalted MD5 password storage and insecure credential files. Versions before 2026.MS3 or 2026.MS4 (depending on the CVE) are affected; some issues have no fixed version listed.

- **Published:** 2026-10-23T07:28:26Z
- **Last reviewed:** 2026-10-23T07:28:26Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4237
- **ID:** TL-2026-4237
- **Severity:** HIGH
- **Category:** VULNERABILITY
- **Status:** MONITORING
- **Detections:** 9 · **IOCs:** 8 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2025-30043, CVE-2025-30045, CVE-2025-30046, CVE-2025-30047, CVE-2025-30049, CVE-2025-30050, CVE-2025-30051, CVE-2025-30052, CVE-2025-30053, CVE-2025-30054, CVE-2025-58403, CVE-2025-2313, CVE-2025-10350, CVE-2025-30035

## Description

On 2026-10-23 CERT Polska published an advisory covering 11 CVEs in CGM CLININET, a healthcare information system. All were reported by Maciej Kazulak under CERT Polska coordinated vulnerability disclosure. The advisory gives no CVSS scores, no evidence of in-the-wild exploitation, no public PoC, no attribution and no network IOCs. The severity (HIGH) is an analyst assignment based on the described impact, not a source-stated rating.

Unauthenticated / network-reachable weaknesses: CVE-2025-30043 (CWE-306) - the /DocManagment endpoint lacks authentication, so an unauthenticated attacker on an adjacent network can list and download patient documents (fixed in 2026.MS3). CVE-2025-30053 (CWE-306) - the cgm-updater process listens on an open network port without any authentication (all versions through 2026.MS4, possibly later; no fixed version stated). CVE-2025-30052 (CWE-290) - rsyncd grants access based solely on the client source IP address, so a spoofed source address permits file editing (through 2026.MS4, possibly later).

Remote code execution / root-level impact: CVE-2025-30050 (CWE-94) - RunCGI.pm dynamically imports the module named in a query parameter and executes code from untrusted data, giving root-level code execution (fixed in 2026.MS3). CVE-2025-30047 (CWE-502) - the HTTP API deserializes Java objects, so crafted serialized objects sent from the local network yield arbitrary code execution as root (fixed in 2026.MS3). CVE-2025-30045 (CWE-94) - the ConvExpr function, which turns Perl expressions into RTF document content, lets an authenticated high-privileged user execute arbitrary code as root (fixed in 2026.MS4). CVE-2025-30046 (CWE-250) - several HL7 communication processes run as root while handling untrusted external data, enabling remote code execution from an adjacent network (through 2026.MS4, possibly later).

Credential and permission weaknesses: CVE-2025-30049 (CWE-916) - user passwords are stored as unsalted MD5 hashes (fixed in 2026.MS1 and 2026.MS3). CVE-2025-30051 (CWE-732) - SysIO.pl holds production database and RabbitMQ broker credentials with permissions that let any local account read them (fixed in 2026.MS3). CVE-2025-30054 (CWE-732) - files and scripts used by the root-running HL7 message processing service are modifiable by the uhcapache user, allowing local privilege escalation to root (fixed in 2026.MS4). CVE-2025-58403 is labeled Cross-site Scripting (CWE-79) with a fix in 2026.MS4, but the advisory text for it repeats the cgm-updater open-port wording used for CVE-2025-30053, so the exact XSS mechanism is unconfirmed. NVD had no records for the CVEs checked at research time.

This follows earlier CERT Polska advisories on CGM CLININET (August 2025 and March 2026) covering SQL injection, authentication bypass and RCE. Recommended actions from the source: upgrade to the fixed releases and apply network segmentation to healthcare systems.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1078 Valid Accounts
- T1059 Command and Scripting Interpreter
- T1552.001 Credentials In Files
- T1110.002 Password Cracking
- T1213 Data from Information Repositories
- T1565.001 Stored Data Manipulation

## Sources

- [CERT Polska - Vulnerabilities in CGM CLININET software](https://cert.pl/en/posts/2026/10/CVE-2025-30043/)
- [CERT Polska - CVE-2025-2313 (earlier CGM CLININET advisory)](https://cert.pl/en/posts/2025/08/CVE-2025-2313)
- [CERT Polska - CVE-2025-10350 (earlier CGM CLININET advisory)](https://cert.pl/en/posts/2026/03/CVE-2025-10350/)
- [CERT Polska Coordinated Vulnerability Disclosure policy](https://cert.pl/en/cvd/)
- [CGM CLININET CVE listing (cve.imfht.com)](https://cve.imfht.com/product/CGM%20CLININET?lang=en)
- [GCVE record for CVE-2025-30035 (related CGM CLININET authentication bypass)](https://db.gcve.eu/vuln/CVE-2025-30035)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4237