Which versions of CGM CLININET are affected by CVE-2025-30044?

CGM CLININET, the clinical information system deployed across healthcare organizations, contains a critical remote code execution vulnerability (CVE-2025-30044, CVSS 9.4) that could allow attackers…

How to fix or mitigate CVE-2025-30044?

Within 24 hours: Identify all CGM CLININET installations in your healthcare environment and assess network connectivity from clinical workstations and adjacent network segments; alert clinical leadership to prepare contingency plans for potential service disruptions. Within 7 days: Implement network segmentation and access controls restricting CGM CLININET web interface connectivity to authorized clinical staff only; disable or restrict access to vulnerable CGI endpoints (usrlogstat_simple.pl, usrlogstat.pl, userlogstat2.pl, dblogstat.pl) if operationally feasible; enable comprehensive logging on web interface access. Within 30 days: Contact CompuGroup Medical for vendor patch timeline and request remediation guidance; if no patch is expected within 30 days, initiate procurement and testing of alternative hospital information systems; conduct forensic analysis of CLININET access logs for evidence of exploitation attempts or suspicious parameter activity.

CGM CLININET CVE-2025-30044

Q: What is the CVSS score of CVE-2025-30044?

CVE-2025-30044 has a CVSS 4.0 base score of 9.4 (Critical). CVSS vector: CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

CRITICAL

OS Command Injection (CWE-78)

2026-03-02 cvd@cert.pl

Command Injection

9.4

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

9.4 CRITICAL

CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.6 CRITICAL

Unauthenticated command injection reachable from the adjacent network (AV:A/PR:N/UI:N/AC:L); scope change (S:C) reflects OS command execution impacting backend systems with full C/I/A loss.

3.1 AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

4.0 AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

Apr 27, 2026 - 19:22 NVD

9.4 (CRITICAL)

Analysis Generated

Mar 12, 2026 - 21:55 vuln.today

CVE Published

Mar 02, 2026 - 12:16 cve.org

CRITICAL 9.4

CVE Published

Mar 02, 2026 - 12:16 nvd

N/A

DescriptionCVE.org

In the endpoints "/cgi-bin/CliniNET.prd/utils/usrlogstat_simple.pl", "/cgi-bin/CliniNET.prd/utils/usrlogstat.pl", "/cgi-bin/CliniNET.prd/utils/userlogstat2.pl", and "/cgi-bin/CliniNET.prd/utils/dblogstat.pl", the parameters are not sufficiently normalized, which enables code injection.

AnalysisAI

OS command injection in CGM CLININET (a hospital information system by CompuGroup Medical) lets attackers with adjacent-network access to the web interface execute arbitrary operating-system commands by supplying insufficiently normalized parameters to four Perl CGI utility endpoints (usrlogstat_simple.pl, usrlogstat.pl, userlogstat2.pl, and dblogstat.pl). The CVSS 4.0 base score is 9.4 (Critical) with no privileges or user interaction required and a scope change into subsequent systems, though EPSS exploitation probability is very low (0.03%) and no public exploit identified at time of analysis. Discovered and reported by CERT Polska (cert.pl).

Technical ContextAI

The affected component is CGM CLININET, a clinical/hospital information system whose web tier exposes CGI scripts written in Perl under the /cgi-bin/CliniNET.prd/utils/ path. The flaw is CWE-78 (Improper Neutralization of Special Elements used in an OS Command), meaning user-supplied request parameters are passed toward a shell or command execution context without adequate sanitization/normalization. In Perl CGI, this typically arises from unsafe use of constructs such as backticks, system(), open() with a pipe, or qx// on tainted input; because the input is 'not sufficiently normalized,' shell metacharacters (;, |, `, $(...)) or path/encoding tricks likely survive into the executed command. The CVSS 4.0 vector's subsequent-system impact (SC:H/SI:H/SA:H) indicates command execution can affect systems beyond the vulnerable CGI process - consistent with a backend hospital database/application host reachable from the web layer.

Affected ProductsAI

The affected product is CGM CLININET, a hospital information system from CompuGroup Medical (product page: https://www.cgm.com/pol_pl/products/szpital/cgm-clininet.html, indicating primary distribution in Poland). Vulnerable functionality resides in the CGI endpoints /cgi-bin/CliniNET.prd/utils/usrlogstat_simple.pl, /cgi-bin/CliniNET.prd/utils/usrlogstat.pl, /cgi-bin/CliniNET.prd/utils/userlogstat2.pl, and /cgi-bin/CliniNET.prd/utils/dblogstat.pl. No CPE strings and no specific affected/fixed version numbers were provided in the source data, so the exact vulnerable version range could not be determined from the available intelligence; the CERT Polska advisory (https://cert.pl/en/posts/2026/03/CVE-2025-10350/) is the relevant coordinating reference.

RemediationAI

No vendor-released patch version was identified in the available data, so consult CompuGroup Medical and the CERT Polska advisory (https://cert.pl/en/posts/2026/03/CVE-2025-10350/) for the fixed release and apply it once published. As specific compensating controls until a patch is deployed: block or restrict HTTP access to the four vulnerable paths (usrlogstat_simple.pl, usrlogstat.pl, userlogstat2.pl, dblogstat.pl) under /cgi-bin/CliniNET.prd/utils/ via a reverse proxy or WAF rule - trade-off is that any legitimate log/statistics reporting these scripts provide will break; place the CLININET web interface behind strict network segmentation and an authenticating gateway so only clinical administrator hosts on trusted VLANs can reach it, reducing the adjacent-network exposure at the cost of added access friction; and enable WAF input filtering to reject shell metacharacters (;, |, backtick, $(), &&) on these endpoints, accepting possible false positives on legitimate parameter values. Because the impact is OS command execution, also review the CGI process's OS privileges and constrain them (least privilege) to limit blast radius.