CGM CLININET patches multiple healthcare RCE flaws
Free public brief. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them, no card.
CERT Polska coordinated disclosure of 12 CVEs in CGM CLININET hospital software, including unauthenticated root RCE and unauthenticated patient document access.
CERT Polska disclosed a set of 12 vulnerabilities in CGM CLININET, a hospital/clinical information system, reported by researcher Maciej Kazulak and coordinated through CERT Polska's CVD process. The flaws span missing authentication on a patient-document endpoint (CVE-2025-30043), multiple code-injection and deserialization bugs allowing arbitrary code execution as root (CVE-2025-30045, CVE-2025-30046, CVE-2025-30047, CVE-2025-30050), insecure credential storage (unsalted MD5 passwords in CVE-2025-30049, plaintext DB/RabbitMQ credentials readable by any local user in CVE-2025-30051), an IP-spoofing authentication bypass in the rsyncd service (CVE-2025-30052), unauthenticated cgm-updater network services (CVE-2025-30053/CVE-2025-58403), local privilege escalation via misconfigured HL7 processing permissions (CVE-2025-30054), and a reflected/stored XSS issue (CVE-2025-58403... actually CWE-79 listed separately).
Several of the most severe issues require only adjacent-network access (no authentication) to achieve remote code execution with root privileges, notably the HL7 communication processes (CVE-2025-30046) and the Java deserialization API (CVE-2025-30047), while others require low-privileged local access to escalate. The unauthenticated /DocManagment endpoint (CVE-2025-30043) directly exposes patient documents without any credentials, a significant privacy risk for healthcare operators. No in-the-wild exploitation has been reported; this is a coordinated vendor disclosure with fixes released across versions 2026.MS1 through 2026.MS4.
Defenders running CGM CLININET should update to 2026.MS4 or later as soon as possible, verify that administrative APIs, rsyncd, cgm-updater, and HL7 interfaces are not exposed to untrusted networks, rotate any credentials stored in SysIO.pl, and force a password reset given the weak MD5 hashing scheme. Network segmentation restricting adjacent-network access to clinical application servers is a key mitigating control pending patching.
Mentioned in this report
Source reporting: https://cert.pl/en/posts/2026/10/CVE-2025-30043
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 14,026 reports from 142 sources, 522 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs