How do I check whether I am affected by CVE-2025-30047?

Check the installed CLININET release: anything older than 2026.MS3 is affected. The CERT Polska advisory names no endpoint or port for the administrative API, so there is no published probe. Ask CGM which service and port it uses and check whether it is reachable from other network segments. The CVSS vector (PR:N) indicates no login is needed, but the advisory does not say so in words.

What is the fix for CVE-2025-30047?

Upgrade CGM CLININET to version 2026.MS3 or later.

Who is not affected by CVE-2025-30047?

Not affected if: managed-hosting, version-2026.ms3-or-later.

Live › vulnerability › CVE-2025-30047

Go to dashboard

critical9.4Other

CGM CLININET: untrusted Java deserialization lets local network attackers run root code

CGM CLININET's administrative HTTP API deserializes Java objects sent by clients without checking them. An attacker on the same local network can send a crafted serialized object and run arbitrary code on the server as root.

Summary written from the sources below. Check the originals before acting.

CVSS 4.0

9.4

critical

scored by [email protected]

known so far6 of 6

First public: Oct 23, 2026 UTC
Last modified: Oct 23, 2026
Status: open
Known exploitation: None reported
Public exploit: None on GitHub
EPSS: 0.4% in 30d

First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.

Why it is critical, and not just CVSS

Likelihood → · Impact ↓

critical

high

medium

high

medium

low

medium

low

Exploited: No reports yet.
Needs login: Not known from the sources.
Needs a special setup: Not known from the sources.
Reachable from: network.
Worst case: Attacker runs code as root on the CLININET server, reading patient data.
CVSS said: 9.4. The facts above say medium; we keep the sources' critical until an analyst looks.

Who is affected

1 product

Know the next one before it finds you.

Add to Slack

Live › vulnerability › CVE-2025-30047

Go to dashboard

critical9.4Other

CGM CLININET: untrusted Java deserialization lets local network attackers run root code

Summary written from the sources below. Check the originals before acting.

CVSS 4.0

9.4

critical

scored by [email protected]

known so far6 of 6

First public: Oct 23, 2026 UTC
Last modified: Oct 23, 2026
Status: open
Known exploitation: None reported
Public exploit: None on GitHub
EPSS: 0.4% in 30d

First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.

Why it is critical, and not just CVSS

Likelihood → · Impact ↓

critical

high

medium

high

medium

low

medium

low

Exploited: No reports yet.
Needs login: Not known from the sources.
Needs a special setup: Not known from the sources.
Reachable from: network.
Worst case: Attacker runs code as root on the CLININET server, reading patient data.
CVSS said: 9.4. The facts above say medium; we keep the sources' critical until an analyst looks.

Who is affected

1 product

Know the next one before it finds you.

Add to Slack

CGM CLININET: untrusted Java deserialization lets local network attackers run root code

Why it is critical, and not just CVSS

Who is affected

Know the next one before it finds you.

CGM CLININET: untrusted Java deserialization lets local network attackers run root code

Why it is critical, and not just CVSS

Who is affected

Know the next one before it finds you.

How to check

The fix

Who had it, and when

What the sources say, verbatim

Sources