---
id: "CVE-2025-30047"
kind: "vulnerability"
aliases: ["CVE-2025-30047"]
title: "CGM CLININET: untrusted Java deserialization lets local network attackers run root code"
severity: "critical"
cvss: 9.4
epss: 0.00379
exploited: false
status: "open"
category: "other"
products: [{"name": "CGM CLININET", "fixed": ["2026.MS3"], "affected": "< 2026.MS3", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["cgm-clinicnet", "clinical-software", "deserialization", "java", "on-premises", "other"]
not_affected_if: ["managed-hosting", "version-2026.ms3-or-later"]
published_at: "2026-10-23T09:17:04+00:00"
first_seen_at: "2026-10-23T21:57:32+00:00"
updated_at: "2026-10-24T07:15:51+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-30047", "first_seen_at": "2026-10-23T21:57:32+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T22:12:22+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T22:38:08+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2025-30047", "first_seen_at": "2026-10-24T07:15:51+00:00"}]
---

# CGM CLININET: untrusted Java deserialization lets local network attackers run root code

CGM CLININET's administrative HTTP API deserializes Java objects sent by clients without checking them. An attacker on the same local network can send a crafted serialized object and run arbitrary code on the server as root.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:CGM CLININET affected < 2026.MS3 fixed 2026.MS3

## How to check

Check the installed CLININET release: anything older than 2026.MS3 is affected. The CERT Polska advisory names no endpoint or port for the administrative API, so there is no published probe. Ask CGM which service and port it uses and check whether it is reachable from other network segments. The CVSS vector (PR:N) indicates no login is needed, but the advisory does not say so in words.

## Fix

Upgrade CGM CLININET to version 2026.MS3 or later.

## Timeline

- 2026-10-23T21:57:32+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2025-30047
- 2026-10-23T22:12:22+00:00 analyst — CERT Polska advisory and CVE record (both 2026-10-23): all CLININET before 2026.MS3 affected, fixed in 2026.MS3, CVSS4 9.4 adjacent network. No exploitation or PoC found; no KEV. No public detection method; CGM has no English advisory found. Did not search social posts (disclosed hours ago).
- 2026-10-23T22:38:08+00:00 analyst — Return visit: no new sources. Re-read CERT Polska advisory: it does not say the admin API needs login, and the CVSS 4.0 vector has PR:N, so treat it as unauthenticated (inferred, not stated). It gives no endpoint or port. Nothing else changed.
- 2026-10-24T07:15:51+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2025-30047

## Documents

- [advisory] CERT Polska: Vulnerabilities in CGM CLININET software https://cert.pl/en/posts/2026/10/CVE-2025-30043/
- [describes] CVE Record: CVE-2025-30047 https://www.cve.org/CVERecord?id=CVE-2025-30047

## From the sources

CGM CLININET is vulnerable to Remote Code Execution caused by deserialization of untrusted data. The server exposes an HTTP-based API, used by the administrative module, that exchanges data using Java object serialization. An attacker within the same local network is able to send requests to this API and transmit a crafted serialized object. When it is deserialized, it allows arbitrary code execution with root privileges on the server. 


This issue was fixed in version 2026.MS3

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_