{"id":"CVE-2025-30046","kind":"vulnerability","aliases":["CVE-2025-30046"],"related":[],"title":"CGM CLININET: HL7 processes run as root, letting network attackers execute code","description":"In the CGM CLININET application server, multiple processes responsible for HL7 communication with external systems run with root privileges while processing untrusted data received from those external systems. An attacker in adjacent network able to send data to these HL7 communication processes can achieve remote code execution with root privileges. \n\n\nThe vulnerability was confirmed to affect versions up to 2026.MS3 but later versions may also be vulnerable.","summary":"CGM CLININET application servers run several HL7 communication processes as root while parsing untrusted data from external systems. An attacker on the adjacent network who can send data to them can execute code as root. CERT Polska confirms all versions up to and including 2026.MS3 are affected, and later ones may be. No fix has been published. CVSS 4.0 is 9.0. Same disclosure batch as 10 other CLININET CVEs, including CVE-2025-30054, a local root escalation through the HL7 service's writable scripts.","severity":"critical","cvss":9.0,"epss":0.00263,"exploited":false,"exploited_at":null,"products":[{"name":"CGM CLININET","fixed":[],"affected":"<= 2026.MS3","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["cgm-clininet","healthcare","hl7","other","rce","root","self-hosted"],"not_affected_if":["hl7-not-exposed","no-adjacent-network-access","not-running-clininet"],"how_to_check":"Check your CLININET version: 2026.MS3 or earlier is affected, and no later version is confirmed safe. On the server, list the HL7 communication processes (ps -eo user,pid,cmd, then grep for hl7) and see whether they run as root. Check which hosts and networks can reach the HL7 listener ports.","fix":"No fixed release published as of 2026-10-23. Ask CGM for a fix and for the list of affected HL7 processes. Until then, restrict network access to the HL7 ports to trusted interfacing systems only (firewall or segmentation), and monitor the server. Upgrading to 2026.MS3 fixes sibling CVEs (for example 30043, 30047, 30050) but not this one.","status":"open","published_at":"2026-10-23T09:17:04+00:00","first_seen_at":"2026-10-23T21:57:32+00:00","triaged_at":"2026-10-23T22:31:33+00:00","updated_at":"2026-10-24T07:15:51+00:00","category":"other","confidence":0.8,"triage":{"at":"2026-10-23T22:31:33Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"CGM CLININET: HL7 processes run as root, letting network attackers execute code","impact":"high","summary":"CGM CLININET application servers run several HL7 communication processes as root while parsing untrusted data from external systems. An attacker on the adjacent network who can send data to those processes can execute code with root privileges.","category":"other","who_cares":["cgm-clininet","healthcare","hl7","self-hosted"],"confidence":0.7,"needs_auth":"no","worst_case":"Attacker runs code as root on the CLININET application server","analyst_note":"Ask CGM for the fixed release and the list of HL7 processes affected; the sources say only that versions up to 2026.MS3 are confirmed and later ones may be too.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["no-adjacent-network-access","not-running-clininet"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000472,"input_tokens":2955,"output_tokens":352,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Ask CGM for the fixed release and the list of HL7 processes affected; the sources say only that versions up to 2026.MS3 are confirmed and later ones may be too.","search":"'-2025':14A,17A,104B '-30046':15A,18A '-30054':105B '10':98B '2026':76B,176C '4.0':91B '9.0':93B 'abl':150C 'achiev':160C 'adjac':54B,148C 'affect':79B,172C 'also':182C 'applic':34B,121C 'attack':10A,51B,146C 'batch':96B 'cert':67B 'cgm':1A,19A,22B,32B,119C 'cgm-clininet':21B 'clininet':2A,20A,23B,33B,100B,120C 'code':12A,64B,162C 'communic':39B,128C,157C 'confirm':69B,170C 'cve':13A,16A,103B 'cves':101B 'cvss':90B 'data':46B,59B,139C,153C 'disclosur':95B 'escal':109B 'execut':11A,63B,163C 'extern':48B,130C,143C 'fix':86B 'healthcar':24B 'hl7':3A,25B,38B,112B,127C,156C 'host':31B 'includ':75B,102B 'later':81B,179C 'let':8A 'local':107B 'may':83B,181C 'ms3':77B,177C 'multipl':123C 'network':9A,55B,149C 'one':82B 'pars':44B 'polska':68B 'privileg':135C,166C 'process':4A,40B,124C,137C,158C 'publish':89B 'rce':27B 'receiv':140C 'remot':161C 'respons':125C 'root':7A,28B,42B,66B,108B,134C,165C 'run':5A,36B,132C 'script':116B 'self':30B 'self-host':29B 'send':58B,152C 'server':35B,122C 'servic':113B 'sever':37B 'system':49B,131C,144C 'untrust':45B,138C 'version':71B,173C,180C 'vulner':168C,184C 'writabl':115B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T09:17:04+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cvd@cert.pl","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2025-30046","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-30046","severity":null,"published_at":"2026-10-23T09:17:04+00:00","modified_at":"2026-10-23T16:28:32+00:00","first_seen_at":"2026-10-23T21:57:32+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null},{"source":"analyst","external_id":"CVE-2025-30046:269","url":null,"severity":null,"published_at":"2026-10-23T22:39:37+00:00","modified_at":"2026-10-23T22:39:37+00:00","first_seen_at":"2026-10-23T22:39:37+00:00","fetched_at":"2026-10-23T22:39:37+00:00","note":"Read CERT Polska advisory (primary, coordinated disclosure, reporter Maciej Kazulak). Affects all versions through 2026.MS3; NO fixed release exists (2026.MS3 fixes sibling CVEs only). No CGM advisory found, no exploitation or PoC found (KEV false). Not searched X/HN: new, niche."},{"source":"epss","external_id":"CVE-2025-30046","url":"https://api.first.org/data/v1/epss?cve=CVE-2025-30046","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:51+00:00","fetched_at":"2026-10-25T12:38:51+00:00","note":null}],"documents":[{"id":1323,"url":"https://cert.pl/en/posts/2026/10/CVE-2025-30043/","title":"CERT Polska: Vulnerabilities in CGM CLININET software","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1555,"url":"https://trustlist.uk/security-advisories/cgm-clininet-hospital-software-eleven-flaws-root-code-execution-several-unfixed-cert-polska","title":"TrustList: CERT Polska lists 11 CGM CLININET flaws","kind":"blog","source":"analyst","text":null,"published_at":null,"relation":"discussion","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}