{"id":"CVE-2025-30054","kind":"vulnerability","aliases":["CVE-2025-30054"],"related":[],"title":"CGM CLININET: uhcapache user can modify root-run HL7 scripts, gaining root","description":"CGM CLININET is vulnerable to local privilege escalation. The service that processes incoming HL7 messages runs with root privileges, but due to incorrect permissions, its scripts and configuration files can be modified by the uhcapache user. An attacker with uhcapache privileges can modify these files to execute arbitrary code as root.\n\n\nThe vulnerability was confirmed to affect versions up to 2026.MS3 but later versions may also be vulnerable.","summary":"CGM CLININET's HL7 message service runs as root but its scripts and config files are writable by the uhcapache user. An attacker who holds uhcapache rights can edit those files and run arbitrary code as root.","severity":"critical","cvss":9.3,"epss":0.001,"exploited":false,"exploited_at":null,"products":[{"name":"CGM CLININET","fixed":[],"affected":"<= 2026.MS3","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["cgm-clininet","healthcare","linux","other","privilege-escalation","self-hosted","windows"],"not_affected_if":["managed-hosting"],"how_to_check":null,"fix":"No fixed version confirmed. CVE record and CERT Polska say all versions through 2026.MS3 are affected. One aggregator (notcve.org) claims a fix in 2026.MS4, but the CVE record does not say that, so ask CGM to confirm before relying on it. Until then, remove uhcapache write access to the HL7 service's scripts and config, limit who can get uhcapache access, and keep HL7 and admin ports off untrusted networks.","status":"open","published_at":"2026-10-23T09:17:05+00:00","first_seen_at":"2026-10-23T21:57:32+00:00","triaged_at":"2026-10-23T22:31:28+00:00","updated_at":"2026-10-24T07:15:51+00:00","category":"other","confidence":0.75,"triage":{"at":"2026-10-23T22:31:28Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"CGM CLININET: uhcapache user can modify root-run HL7 scripts, gaining root","impact":"high","summary":"CGM CLININET's HL7 message service runs as root but its scripts and config files are writable by the uhcapache user. An attacker who holds uhcapache rights can edit those files and run arbitrary code as root.","category":"other","who_cares":["cgm-clininet","healthcare","self-hosted","windows","linux"],"confidence":0.6,"needs_auth":"yes","worst_case":"Code runs as root on the server; all data readable.","analyst_note":"Find the vendor advisory or patched version beyond 2026.MS3 and the affected file paths; check the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2025-30054.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["managed-hosting"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000482,"input_tokens":3005,"output_tokens":362,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Find the vendor advisory or patched version beyond 2026.MS3 and the affected file paths; check the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2025-30054.","search":"'-2025':15A,18A '-30054':16A,19A '2026':132C 'affect':128C 'also':138C 'arbitrari':68B,119C 'attack':57B,109C 'cgm':1A,20A,23B,35B,72C 'cgm-clininet':22B 'clininet':2A,21A,24B,36B,73C 'code':69B,120C 'config':48B 'configur':99C 'confirm':126C 'cve':14A,17A 'due':92C 'edit':63B 'escal':30B,79C 'execut':118C 'file':49B,65B,100C,116C 'gain':12A 'healthcar':25B 'hl7':10A,38B,85C 'hold':59B 'host':33B 'incom':84C 'incorrect':94C 'later':135C 'linux':26B 'local':77C 'may':137C 'messag':39B,86C 'modifi':6A,103C,114C 'ms3':133C 'permiss':95C 'privileg':29B,78C,90C,112C 'privilege-escal':28B 'process':83C 'right':61B 'root':8A,13A,43B,71B,89C,122C 'root-run':7A 'run':9A,41B,67B,87C 'script':11A,46B,97C 'self':32B 'self-host':31B 'servic':40B,81C 'uhcapach':3A,54B,60B,106C,111C 'user':4A,55B,107C 'version':129C,136C 'vulner':75C,124C,140C 'window':34B 'writabl':51B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T09:17:05+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cvd@cert.pl","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2025-30054","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-30054","severity":null,"published_at":"2026-10-23T09:17:05+00:00","modified_at":"2026-10-23T16:28:32+00:00","first_seen_at":"2026-10-23T21:57:32+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null},{"source":"analyst","external_id":"CVE-2025-30054:177","url":null,"severity":null,"published_at":"2026-10-23T22:12:31+00:00","modified_at":"2026-10-23T22:12:31+00:00","first_seen_at":"2026-10-23T22:12:31+00:00","fetched_at":"2026-10-23T22:12:31+00:00","note":"Read CERT Polska advisory (primary, coordinated disclosure; no CGM advisory found). Affects all versions through 2026.MS3, no fixed version exists; later may be affected. CVSS 4.0 9.3 is local/PR:L, so critical rating rests on needing uhcapache access. No exploit or PoC public (VulDB), not in KEV. Same advisory covers 10 sibling CLININET CVEs (30045/30046/30052/30053 also unfixed). Tag 'windows' looks wrong: root/uhcapache implies Linux. Did not search social."},{"source":"analyst","external_id":"CVE-2025-30054:264","url":null,"severity":null,"published_at":"2026-10-23T22:37:34+00:00","modified_at":"2026-10-23T22:37:34+00:00","first_seen_at":"2026-10-23T22:37:34+00:00","fetched_at":"2026-10-23T22:37:34+00:00","note":"Re-check: no new primary source. The CNA record (CERT-PL, cveawg JSON) and cert.pl still say affected through 2026.MS3, no fixed version. The notcve.org aggregator shows a second description ending 'fixed in version 2026.MS4', which appears in neither the CVE record nor cert.pl; left unconfirmed, fixed stays empty. CGM page is Polish product page only. File paths still not published. Settle it by checking a CGM or CERT Polska update for 2026.MS4."},{"source":"epss","external_id":"CVE-2025-30054","url":"https://api.first.org/data/v1/epss?cve=CVE-2025-30054","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:51+00:00","fetched_at":"2026-10-25T12:38:51+00:00","note":null}],"documents":[{"id":1323,"url":"https://cert.pl/en/posts/2026/10/CVE-2025-30043/","title":"CERT Polska: Vulnerabilities in CGM CLININET software","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1540,"url":"https://cveawg.mitre.org/api/cve/CVE-2025-30054","title":"CVE record (CNA CERT-PL) CVE-2025-30054, JSON","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":1541,"url":"https://notcve.org/cve/CVE-2025-30054","title":"NotCVE aggregator: CVE-2025-30054 (shows an unverified 'fixed in 2026.MS4' description)","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}