CGM CLININET EUVD-2025-211178

Exploitation requires network reachability to the CGM CLININET administrative module's HTTP-based API, which exchanges data using native Java object serialization - the attacker sends a crafted serialized object that is deserialized without validation. Per CVSS PR:N and the description, no authentication is required. The principal limiting factor is the attack vector: AV:A means the attacker must reside on the same local/adjacent network as the server, not the open internet, so an existing LAN foothold or insider position is a prerequisite. No user interaction is required (UI:N) and the attack works against the exposed API in its described configuration. Successful deserialization grants code execution as root.

This is a genuine high priority, and the available signals are consistent rather than conflicting. The CVSS 4.0 vector (AV:A/AC:L/AT:N/PR:N/UI:N) matches the description precisely: an unauthenticated attacker with low complexity and no user interaction, limited to the adjacent/local network, achieves full compromise (VC:H/VI:H/VA:H) via Java deserialization (CWE-502) yielding root-level code execution. The vuln.today Decision label is act_now and the finding was reported by CERT-PL, a credible national CSIRT, which raises confidence in the technical details. The key tempering factor is the attack vector: AV:A (adjacent network), not AV:N (internet-wide), so exploitation requires a foothold on the same local network as the CGM CLININET server rather than direct internet exposure - this narrows the realistic attacker set to insiders or an attacker who has already breached the hospital LAN. No EPSS score, no CISA KEV listing, and no POC reference are present in the input, so there is no evidence of active exploitation or weaponization; the urgency here derives from the act_now decision label and the severity of root RCE, not from observed exploitation. Note the reference URL discrepancy (see confidence_notes), which slightly reduces confidence in the supporting documentation but not in the core vector.

An attacker who already has a presence on the hospital's local network (e.g., a compromised workstation, a rogue device, or a malicious insider) locates the CGM CLININET administrative HTTP API and sends it a crafted serialized Java object. When the server deserializes the untrusted object, arbitrary code runs with root privileges, giving full control of the clinical server. No public exploit is identified in the provided data, but the class (Java deserialization, CWE-502) is well understood and reliably exploitable once the endpoint is reachable.