---
id: "CVE-2025-30046"
kind: "vulnerability"
aliases: ["CVE-2025-30046"]
title: "CGM CLININET: HL7 processes run as root, letting network attackers execute code"
severity: "critical"
cvss: 9.0
epss: 0.00263
exploited: false
status: "open"
category: "other"
products: [{"name": "CGM CLININET", "fixed": [], "affected": "<= 2026.MS3", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["cgm-clininet", "healthcare", "hl7", "other", "rce", "root", "self-hosted"]
not_affected_if: ["hl7-not-exposed", "no-adjacent-network-access", "not-running-clininet"]
published_at: "2026-10-23T09:17:04+00:00"
first_seen_at: "2026-10-23T21:57:32+00:00"
updated_at: "2026-10-24T07:15:51+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-30046", "first_seen_at": "2026-10-23T21:57:32+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T22:39:37+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2025-30046", "first_seen_at": "2026-10-24T07:15:51+00:00"}]
---

# CGM CLININET: HL7 processes run as root, letting network attackers execute code

CGM CLININET application servers run several HL7 communication processes as root while parsing untrusted data from external systems. An attacker on the adjacent network who can send data to them can execute code as root. CERT Polska confirms all versions up to and including 2026.MS3 are affected, and later ones may be. No fix has been published. CVSS 4.0 is 9.0. Same disclosure batch as 10 other CLININET CVEs, including CVE-2025-30054, a local root escalation through the HL7 service's writable scripts.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:CGM CLININET affected <= 2026.MS3 fixed ?

## How to check

Check your CLININET version: 2026.MS3 or earlier is affected, and no later version is confirmed safe. On the server, list the HL7 communication processes (ps -eo user,pid,cmd, then grep for hl7) and see whether they run as root. Check which hosts and networks can reach the HL7 listener ports.

## Fix

No fixed release published as of 2026-10-23. Ask CGM for a fix and for the list of affected HL7 processes. Until then, restrict network access to the HL7 ports to trusted interfacing systems only (firewall or segmentation), and monitor the server. Upgrading to 2026.MS3 fixes sibling CVEs (for example 30043, 30047, 30050) but not this one.

## Timeline

- 2026-10-23T21:57:32+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2025-30046
- 2026-10-23T22:39:37+00:00 analyst — Read CERT Polska advisory (primary, coordinated disclosure, reporter Maciej Kazulak). Affects all versions through 2026.MS3; NO fixed release exists (2026.MS3 fixes sibling CVEs only). No CGM advisory found, no exploitation or PoC found (KEV false). Not searched X/HN: new, niche.
- 2026-10-24T07:15:51+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2025-30046

## Documents

- [advisory] CERT Polska: Vulnerabilities in CGM CLININET software https://cert.pl/en/posts/2026/10/CVE-2025-30043/
- [discussion] TrustList: CERT Polska lists 11 CGM CLININET flaws https://trustlist.uk/security-advisories/cgm-clininet-hospital-software-eleven-flaws-root-code-execution-several-unfixed-cert-polska

## From the sources

In the CGM CLININET application server, multiple processes responsible for HL7 communication with external systems run with root privileges while processing untrusted data received from those external systems. An attacker in adjacent network able to send data to these HL7 communication processes can achieve remote code execution with root privileges. 


The vulnerability was confirmed to affect versions up to 2026.MS3 but later versions may also be vulnerable.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_