Cgm Clininet
Monthly
Reflected cross-site scripting in CGM CLININET (confirmed through version 2026.MS3, with later releases possibly affected) lets a remote attacker supply a crafted URL whose embedded JavaScript or HTML is reflected into the application's response and executed in a clinician's browser, enabling session-cookie theft and actions performed with the victim's privileges. The attacker needs no credentials to build the link, but the payload only fires if an already-authenticated user is persuaded to open it, which is the main limiting factor; impact stays within the victim's browser session rather than the server. This is a moderate, not top-tier, priority for the current month, and no public exploit code was identified at time of analysis. The issue was reported to CERT Polska and is tracked as CWE-79.
Local privilege escalation in CGM CLININET allows anyone who already holds the low-privileged uhcapache account to rewrite the scripts and configuration files belonging to the root-running HL7 message-processing service and thereby execute arbitrary code as root on the hospital server. The root cause is an incorrect permission assignment (CWE-732) on a critical resource, scored 9.3 under CVSS 4.0 and carrying a vuln.today decision label of act_now, with CERT-PL reporting impact up to version 2026.MS3 and later builds possibly affected. No public exploit code has been identified at time of analysis, and exploitation is constrained to local access plus prior possession of the uhcapache account, but the resulting root-level compromise of a clinical information system is severe.
The cgm-updater process shipped with CGM CLININET exposes a network listener that performs no authentication, so anything that can reach that port can interact with the updater service directly. The behaviour is confirmed in versions up to 2026.MS3, and the vendor material does not rule out later builds. Impact is bounded - confidentiality, integrity and availability are all rated Low in the assessed vector - and no public exploit code has been identified at time of analysis; the practical exposure depends on whether the updater port is reachable from untrusted network segments, which in hospital deployments is typically an internal-network question rather than an internet-facing one.
Authentication bypass in the CGM CLININET rsyncd service allows an attacker who can spoof an allow-listed source IP address to reach rsync modules without credentials and edit files on the affected host. The flaw is confirmed in versions through 2026.MS3, with later releases potentially affected, and is only reachable where the rsyncd daemon is network-exposed and configured to authorize clients by source IP alone. No public exploit code or active exploitation is identified at time of analysis; the independent assessment keeps a high severity rating but raises attack complexity because the spoofing must succeed against a TCP service, implying an on-path or packet-injection position rather than arbitrary internet access.
CGM CLININET before 2026.MS3 exposes production database and RabbitMQ broker credentials to any local account because the SysIO.pl configuration file has insecure permissions that make it readable. An attacker with an existing local account on the CLININET application server can read those credentials and use them to attempt access to the production database or message broker, though no remote vector is involved. The issue is rated 6.8 (Medium) by CERT-PL, and no public exploit was identified at the time of analysis.
Code injection in the RunCGI.pm component of CGM CLININET allows an attacker positioned on an adjacent network segment to supply a crafted query parameter naming an arbitrary Perl module, which the component then dynamically imports and executes - resulting in arbitrary code execution with root privileges. Exploitation requires no authentication and no user interaction, but is gated by network reachability to the CGI component from the same local or logical network segment rather than the open internet; all versions prior to 2026.MS3 are affected per the CPE range. Rated 9.4 (CVSS 4.0) and flagged act_now by vuln.today priority scoring, with no public exploit identified at time of analysis; the vendor fixed the flaw in version 2026.MS3.
CGM CLININET stores user passwords as unsalted MD5 hashes, so once a credential store is obtained the passwords can be recovered quickly offline rather than remaining protected by a slow, per-user-salted hash. All versions tracked by the supplied CPE for the product are in scope; the vendor fixed the issue in releases 2026.MS1 and 2026.MS3. The flaw is passive and only weakens credential protection after the hashes are already exposed - it does not itself grant access - but the resulting disclosure of user passwords is rated high severity (CVSS 4.0 base 8.2). No public exploit code has been identified, there is no CISA KEV listing, and priority guidance places remediation in the current week rather than as an emergency.
Remote code execution in CGM CLININET lets unauthenticated attackers on the same local network execute arbitrary code as root by sending a crafted Java-serialized object to the HTTP API used by the administrative module. The flaw affects CLININET installations that expose this API and is fixed in version 2026.MS3; CERT-PL coordinated the disclosure, the priority label is act_now, and no public exploit has been identified at time of analysis.
Remote code execution with root privileges affects CGM CLININET application servers through version 2026.MS3, where HL7 communication processes run as root and parse untrusted data from external systems. An unauthenticated attacker on an adjacent network segment who can deliver data to an exposed HL7 listener can achieve code execution with root privileges; the additional attack requirement encoded as AT:P is not described in the available sources. No public exploit was identified at time of analysis, but the issue is a genuine high-priority item prioritized act_now because of the root-level impact and unauthenticated adjacent-network path.
Code injection in the ConvExpr function of CGM CLININET allows a high-privileged, authenticated user to execute arbitrary Perl code with root privileges on the hospital system by way of crafted RTF document content. The CVSS 4.0 vector (AV:A/PR:H/UI:A, score 8.6) shows the flaw is only reachable from the adjacent network by an account that already holds elevated rights, and it requires the content to actually be processed, so remote unauthenticated exploitation is not possible and the practical threat is a trusted insider or an attacker who has already captured privileged credentials on the hospital network. Affected releases are confirmed through 2026.MS3, the vendor has not published an upper bound, and no public exploit code has been identified at time of analysis.
CGM CLININET exposes its /DocManagment endpoint without an authentication check, allowing unauthenticated attackers on an adjacent network to list and download patient documents. The issue affects CLININET releases before 2026.MS3, is rated 7.1 High with confidentiality-only impact, and has no public exploit identified at time of analysis. Because the attack vector is adjacent rather than internet-facing, near-term risk is concentrated in hospital internal networks and already-compromised segments; CERT-PL places remediation in the this-week priority tier.
Reflected cross-site scripting in CGM CLININET (confirmed through version 2026.MS3, with later releases possibly affected) lets a remote attacker supply a crafted URL whose embedded JavaScript or HTML is reflected into the application's response and executed in a clinician's browser, enabling session-cookie theft and actions performed with the victim's privileges. The attacker needs no credentials to build the link, but the payload only fires if an already-authenticated user is persuaded to open it, which is the main limiting factor; impact stays within the victim's browser session rather than the server. This is a moderate, not top-tier, priority for the current month, and no public exploit code was identified at time of analysis. The issue was reported to CERT Polska and is tracked as CWE-79.
Local privilege escalation in CGM CLININET allows anyone who already holds the low-privileged uhcapache account to rewrite the scripts and configuration files belonging to the root-running HL7 message-processing service and thereby execute arbitrary code as root on the hospital server. The root cause is an incorrect permission assignment (CWE-732) on a critical resource, scored 9.3 under CVSS 4.0 and carrying a vuln.today decision label of act_now, with CERT-PL reporting impact up to version 2026.MS3 and later builds possibly affected. No public exploit code has been identified at time of analysis, and exploitation is constrained to local access plus prior possession of the uhcapache account, but the resulting root-level compromise of a clinical information system is severe.
The cgm-updater process shipped with CGM CLININET exposes a network listener that performs no authentication, so anything that can reach that port can interact with the updater service directly. The behaviour is confirmed in versions up to 2026.MS3, and the vendor material does not rule out later builds. Impact is bounded - confidentiality, integrity and availability are all rated Low in the assessed vector - and no public exploit code has been identified at time of analysis; the practical exposure depends on whether the updater port is reachable from untrusted network segments, which in hospital deployments is typically an internal-network question rather than an internet-facing one.
Authentication bypass in the CGM CLININET rsyncd service allows an attacker who can spoof an allow-listed source IP address to reach rsync modules without credentials and edit files on the affected host. The flaw is confirmed in versions through 2026.MS3, with later releases potentially affected, and is only reachable where the rsyncd daemon is network-exposed and configured to authorize clients by source IP alone. No public exploit code or active exploitation is identified at time of analysis; the independent assessment keeps a high severity rating but raises attack complexity because the spoofing must succeed against a TCP service, implying an on-path or packet-injection position rather than arbitrary internet access.
CGM CLININET before 2026.MS3 exposes production database and RabbitMQ broker credentials to any local account because the SysIO.pl configuration file has insecure permissions that make it readable. An attacker with an existing local account on the CLININET application server can read those credentials and use them to attempt access to the production database or message broker, though no remote vector is involved. The issue is rated 6.8 (Medium) by CERT-PL, and no public exploit was identified at the time of analysis.
Code injection in the RunCGI.pm component of CGM CLININET allows an attacker positioned on an adjacent network segment to supply a crafted query parameter naming an arbitrary Perl module, which the component then dynamically imports and executes - resulting in arbitrary code execution with root privileges. Exploitation requires no authentication and no user interaction, but is gated by network reachability to the CGI component from the same local or logical network segment rather than the open internet; all versions prior to 2026.MS3 are affected per the CPE range. Rated 9.4 (CVSS 4.0) and flagged act_now by vuln.today priority scoring, with no public exploit identified at time of analysis; the vendor fixed the flaw in version 2026.MS3.
CGM CLININET stores user passwords as unsalted MD5 hashes, so once a credential store is obtained the passwords can be recovered quickly offline rather than remaining protected by a slow, per-user-salted hash. All versions tracked by the supplied CPE for the product are in scope; the vendor fixed the issue in releases 2026.MS1 and 2026.MS3. The flaw is passive and only weakens credential protection after the hashes are already exposed - it does not itself grant access - but the resulting disclosure of user passwords is rated high severity (CVSS 4.0 base 8.2). No public exploit code has been identified, there is no CISA KEV listing, and priority guidance places remediation in the current week rather than as an emergency.
Remote code execution in CGM CLININET lets unauthenticated attackers on the same local network execute arbitrary code as root by sending a crafted Java-serialized object to the HTTP API used by the administrative module. The flaw affects CLININET installations that expose this API and is fixed in version 2026.MS3; CERT-PL coordinated the disclosure, the priority label is act_now, and no public exploit has been identified at time of analysis.
Remote code execution with root privileges affects CGM CLININET application servers through version 2026.MS3, where HL7 communication processes run as root and parse untrusted data from external systems. An unauthenticated attacker on an adjacent network segment who can deliver data to an exposed HL7 listener can achieve code execution with root privileges; the additional attack requirement encoded as AT:P is not described in the available sources. No public exploit was identified at time of analysis, but the issue is a genuine high-priority item prioritized act_now because of the root-level impact and unauthenticated adjacent-network path.
Code injection in the ConvExpr function of CGM CLININET allows a high-privileged, authenticated user to execute arbitrary Perl code with root privileges on the hospital system by way of crafted RTF document content. The CVSS 4.0 vector (AV:A/PR:H/UI:A, score 8.6) shows the flaw is only reachable from the adjacent network by an account that already holds elevated rights, and it requires the content to actually be processed, so remote unauthenticated exploitation is not possible and the practical threat is a trusted insider or an attacker who has already captured privileged credentials on the hospital network. Affected releases are confirmed through 2026.MS3, the vendor has not published an upper bound, and no public exploit code has been identified at time of analysis.
CGM CLININET exposes its /DocManagment endpoint without an authentication check, allowing unauthenticated attackers on an adjacent network to list and download patient documents. The issue affects CLININET releases before 2026.MS3, is rated 7.1 High with confidentiality-only impact, and has no public exploit identified at time of analysis. Because the attack vector is adjacent rather than internet-facing, near-term risk is concentrated in hospital internal networks and already-compromised segments; CERT-PL places remediation in the this-week priority tier.