Live › vulnerability › CVE-2025-30050
Go to dashboardCGM CLININET's RunCGI.pm dynamically imports a module named in a query parameter, so an attacker can load a module they control. The result is arbitrary code execution with root privileges.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| CGM CLININET | vendor | < 2026.MS3 | 2026.MS3 |
Check the installed CGM CLININET version against the affected range below 2026.MS3.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
CGM CLININET is vulnerable to Code Injection in the RunCGI.pm component, which dynamically imports the module specified as a query parameter and executes code from untrusted data provided by the user. An attacker from adjacent network can supply a crafted query parameter to have an attacker-controlled module imported which results in arbitrary code execution with root privileges.
This issue was fixed in version 2026.MS3
This page as .md · .json · in your agent: get_signal("CVE-2025-30050")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.