{"id":"CVE-2025-30047","kind":"vulnerability","aliases":["CVE-2025-30047"],"related":[],"title":"CGM CLININET: untrusted Java deserialization lets local network attackers run root code","description":"CGM CLININET is vulnerable to Remote Code Execution caused by deserialization of untrusted data. The server exposes an HTTP-based API, used by the administrative module, that exchanges data using Java object serialization. An attacker within the same local network is able to send requests to this API and transmit a crafted serialized object. When it is deserialized, it allows arbitrary code execution with root privileges on the server. \n\n\nThis issue was fixed in version 2026.MS3","summary":"CGM CLININET's administrative HTTP API deserializes Java objects sent by clients without checking them. An attacker on the same local network can send a crafted serialized object and run arbitrary code on the server as root.","severity":"critical","cvss":9.4,"epss":0.00379,"exploited":false,"exploited_at":null,"products":[{"name":"CGM CLININET","fixed":["2026.MS3"],"affected":"< 2026.MS3","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["cgm-clinicnet","clinical-software","deserialization","java","on-premises","other"],"not_affected_if":["managed-hosting","version-2026.ms3-or-later"],"how_to_check":"Check the installed CLININET release: anything older than 2026.MS3 is affected. The CERT Polska advisory names no endpoint or port for the administrative API, so there is no published probe. Ask CGM which service and port it uses and check whether it is reachable from other network segments. The CVSS vector (PR:N) indicates no login is needed, but the advisory does not say so in words.","fix":"Upgrade CGM CLININET to version 2026.MS3 or later.","status":"open","published_at":"2026-10-23T09:17:04+00:00","first_seen_at":"2026-10-23T21:57:32+00:00","triaged_at":"2026-10-23T22:31:32+00:00","updated_at":"2026-10-24T07:15:51+00:00","category":"other","confidence":0.8,"triage":{"at":"2026-10-23T22:31:32Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade CGM CLININET to version 2026.MS3 or later.","reach":"network","title":"CGM CLININET: untrusted Java deserialization lets local network attackers run root code","impact":"high","summary":"CGM CLININET's administrative HTTP API deserializes Java objects sent by clients without checking them. An attacker on the same local network can send a crafted serialized object and run arbitrary code on the server as root.","category":"other","who_cares":["cgm-clinicnet","clinical-software","on-premises","java"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker runs code as root on the CLININET server, reading patient data.","analyst_note":"Confirm from the vendor advisory whether the administrative API requires login and how to detect the vulnerable endpoint; check the NVD page for the vendor advisory URL.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["managed-hosting","version-2026.MS3-or-later"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000495,"input_tokens":3020,"output_tokens":385,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Confirm from the vendor advisory whether the administrative API requires login and how to detect the vulnerable endpoint; check the NVD page for the vendor advisory URL.","search":"'-2025':14A,17A '-30047':15A,18A '2026':145C 'abl':111C 'administr':35B,94C 'allow':129C 'api':37B,90C,117C 'arbitrari':62B,130C 'attack':9A,48B,104C 'base':89C 'caus':77C 'cgm':1A,19A,22B,32B,69C 'cgm-clinicnet':21B 'check':45B 'client':43B 'clinic':25B 'clinical-softwar':24B 'clinicnet':23B 'clininet':2A,20A,33B,70C 'code':12A,63B,75C,131C 'craft':57B,121C 'cve':13A,16A 'data':82C,98C 'deseri':5A,27B,38B,79C,127C 'exchang':97C 'execut':76C,132C 'expos':85C 'fix':142C 'http':36B,88C 'http-base':87C 'issu':140C 'java':4A,28B,39B,100C 'let':6A 'local':7A,52B,108C 'modul':95C 'ms3':146C 'network':8A,53B,109C 'object':40B,59B,101C,123C 'on-premis':29B 'premis':31B 'privileg':135C 'remot':74C 'request':114C 'root':11A,68B,134C 'run':10A,61B 'send':55B,113C 'sent':41B 'serial':58B,102C,122C 'server':66B,84C,138C 'softwar':26B 'transmit':119C 'untrust':3A,81C 'use':91C,99C 'version':144C 'vulner':72C 'within':105C 'without':44B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T09:17:04+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cvd@cert.pl","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2025-30047","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-30047","severity":null,"published_at":"2026-10-23T09:17:04+00:00","modified_at":"2026-10-23T16:28:32+00:00","first_seen_at":"2026-10-23T21:57:32+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null},{"source":"analyst","external_id":"CVE-2025-30047:179","url":null,"severity":null,"published_at":"2026-10-23T22:12:22+00:00","modified_at":"2026-10-23T22:12:22+00:00","first_seen_at":"2026-10-23T22:12:22+00:00","fetched_at":"2026-10-23T22:12:22+00:00","note":"CERT Polska advisory and CVE record (both 2026-10-23): all CLININET before 2026.MS3 affected, fixed in 2026.MS3, CVSS4 9.4 adjacent network. No exploitation or PoC found; no KEV. No public detection method; CGM has no English advisory found. Did not search social posts (disclosed hours ago)."},{"source":"analyst","external_id":"CVE-2025-30047:268","url":null,"severity":null,"published_at":"2026-10-23T22:38:08+00:00","modified_at":"2026-10-23T22:38:08+00:00","first_seen_at":"2026-10-23T22:38:08+00:00","fetched_at":"2026-10-23T22:38:08+00:00","note":"Return visit: no new sources. Re-read CERT Polska advisory: it does not say the admin API needs login, and the CVSS 4.0 vector has PR:N, so treat it as unauthenticated (inferred, not stated). It gives no endpoint or port. Nothing else changed."},{"source":"epss","external_id":"CVE-2025-30047","url":"https://api.first.org/data/v1/epss?cve=CVE-2025-30047","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:51+00:00","fetched_at":"2026-10-25T12:38:51+00:00","note":null}],"documents":[{"id":1323,"url":"https://cert.pl/en/posts/2026/10/CVE-2025-30043/","title":"CERT Polska: Vulnerabilities in CGM CLININET software","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1324,"url":"https://www.cve.org/CVERecord?id=CVE-2025-30047","title":"CVE Record: CVE-2025-30047","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}