CGM CLININET EUVD-2025-211180

Exploitation requires network reachability to the RunCGI.pm CGI component of CGM CLININET from an adjacent network position (AV:A) - the attacker must be on the same local/logical network segment, not the open internet, which is the principal limiting factor. The specific trigger is supplying a crafted query parameter that names a Perl module; RunCGI.pm then dynamically imports and executes that module from untrusted user input. No authentication is needed (PR:N), no user interaction is required (UI:N), and the description implies default behavior of the component rather than a non-default configuration toggle. Resulting code execution runs with root privileges. The description does not state version-specific or SAPI-specific preconditions beyond versions prior to the 2026.MS3 fix.

This is a genuine high-priority issue, not a high-CVSS-but-low-risk artifact. The vendor-supplied CVSS 4.0 vector (AV:A/AC:L/AT:N/PR:N/UI:N) describes a low-complexity, unauthenticated code-injection flaw reachable without user interaction, and the vuln.today decision label is 'act_now,' the strongest urgency signal in the input. The impact is maximal - arbitrary code execution with root privileges and full confidentiality/integrity/availability loss on both the vulnerable and subsequent systems (VC/VI/VA:H, SC/SI/SA:H). The one factor that meaningfully bounds the risk is the attack vector: AV:A (adjacent) means the attacker must be on the same logical/adjacent network segment rather than reaching the system across the open internet, so this is not an internet-wide mass-exploitation candidate in the way an AV:N bug would be. No EPSS score, no CISA KEV listing, and no public exploit reference are present in the input, so exploitation-probability and in-the-wild signals are simply ABSENT (not low) - their absence should not be read as reassurance given the act_now label and the trivial, well-understood nature of the bug (dynamic module import from a user-controlled query parameter). One data caveat: the only CERT-PL reference URL in the input points to CVE-2025-30043, not CVE-2025-30050 - verify this advisory actually covers this CVE.

An attacker positioned on the same adjacent network as a CGM CLININET deployment (e.g., a compromised device or workstation inside the hospital LAN) sends a crafted HTTP request to the RunCGI.pm endpoint with a query parameter naming an attacker-controlled Perl module. RunCGI.pm dynamically imports and executes that module, yielding arbitrary code execution as root with no authentication and no user interaction (AV:A/AC:L/PR:N/UI:N). No public exploit code is identified in the input, but the trivial mechanism makes weaponization straightforward for an adjacent attacker.