CGM CLININET EUVD-2025-211177

Exploitation requires network reachability to the CGM CLININET HL7 communication processes from an ADJACENT network segment (AV:A) - these processes run with root privileges and parse untrusted data received from external/integrated systems, and no authentication is required (PR:N). The concrete prerequisite is therefore that the attacker can deliver data to an exposed HL7 interface/listener; the limiting factors are that the attacker must already be on an adjacent (not arbitrary remote) network, and that CVSS encodes an additional attack requirement (AT:P) whose specific trigger condition is not described in the available sources. Affected versions are stated up to 2026.MS3, with later versions possibly also affected per the vendor/reporter.

This is a genuine high-priority issue rather than an inflated-CVSS artifact. The CVSS 4.0 base score of 9.0 is driven by unauthenticated access (PR:N), low complexity (AC:L), no user interaction (UI:N), and total compromise of both the vulnerable and subsequent systems (VC/VI/VA:H and SC/SI/SA:H), reflecting that the affected HL7 processes run as root (CWE-250, execution with unnecessary privilege). The vuln.today decision label is act_now and the finding was reported by CERT-PL, a national CERT, which raises confidence that this is a real, prioritised defect. The single meaningful mitigating signal in the vector is the attack vector: AV:A (adjacent network) means the attacker must already have a foothold on a network segment that can reach the HL7 communication processes, not arbitrary Internet reachability. AT:P indicates the CVSS author judged that some additional attack requirement exists, but the available sources do not describe what that requirement or the trigger mechanism actually is, so it should not be read as a strong barrier. Key risk signals are MISSING and should be stated explicitly: no EPSS exploitation-probability score is provided, the CVE is not listed in CISA KEV, and no proof-of-concept or exploit code is referenced. Absence of EPSS/KEV/POC lowers the evidence for active or imminent mass exploitation but does not reduce the technical severity; given act_now and a national-CERT report, treat this as a patch-urgently item for any CGM CLININET deployment.

An attacker who has gained a position on a network segment adjacent to the CGM CLININET application server (for example a compromised device on the hospital/medical-device VLAN used for HL7 integration) sends crafted data to one of the root-privileged HL7 communication processes, which processes it without authentication and is driven to execute attacker-controlled code as root. No public exploit code is identified at time of analysis, so this scenario is inferred from the description and CVSS vector rather than a published PoC.