CGM CLININET CVE-2025-30054

The attacker must already possess the uhcapache user account and local access to the CLININET host; exploitation then abuses incorrect (writable-by-uhcapache) permissions on the scripts and configuration files used by the root-privileged HL7 message-processing service. The limiting factors are: prior compromise of the uhcapache account is mandatory (PR:L), access is local only with no network vector (AV:L), and the root HL7 service must process/execute the tampered files for code to run as root. No user interaction is required. Confirmed to affect versions up to 2026.MS3, with later versions possibly vulnerable.

Multiple decision signals point in the same direction: CVSS 4.0 base score is 9.3 (Critical), the vuln.today Decision label is act_now, and the issue was reported by a national CERT (CERT-PL), which raises credibility. However, the attack vector is explicitly local (AV:L) and requires existing uhcapache-level privileges (PR:L), so this is a privilege-escalation primitive, not a remote entry point - it is most dangerous as the second stage of a chain after an attacker has already compromised the uhcapache application account. No EPSS score is provided in the input, so exploitation probability cannot be quantified. There is no CISA KEV listing and no PoC/exploit reference in the input, so exploitation status is 'no public exploit identified at time of analysis.' The act_now label therefore reflects the trivial technical mechanics (AC:L, misconfigured file permissions, CWE-732) and full root compromise (VC/VI/VA:H, scope change to root) rather than evidence of mass exploitation. Net: a genuine high priority for organizations running CLININET where the uhcapache account is reachable, but the local-only vector and missing EPSS/KEV/PoC signals suggest targeted post-compromise use rather than widespread opportunistic exploitation.

An attacker who has already gained the uhcapache service account (for example via a web-application compromise) notices that the scripts and configuration files consumed by the root-run HL7 message processor are writable by uhcapache. They overwrite one of these files with attacker-controlled commands, which the root service then executes, yielding full root on the hospital system. No public exploit code is identified in the provided data.