# CGM CLININET patches multiple healthcare RCE flaws

Published: 2026-10-23 · Severity: routine · Sectors: Healthcare
Canonical: https://vorant.io/reports/0d4aa2fc-0c48-55b7-9db9-fb9eb4b75c89/cgm-clininet-patches-multiple-healthcare-rce-flaws

> CERT Polska coordinated disclosure of 12 CVEs in CGM CLININET hospital software, including unauthenticated root RCE and unauthenticated patient document access.

CERT Polska disclosed a set of 12 vulnerabilities in CGM CLININET, a hospital/clinical information system, reported by researcher Maciej Kazulak and coordinated through CERT Polska's CVD process. The flaws span missing authentication on a patient-document endpoint (CVE-2025-30043), multiple code-injection and deserialization bugs allowing arbitrary code execution as root (CVE-2025-30045, CVE-2025-30046, CVE-2025-30047, CVE-2025-30050), insecure credential storage (unsalted MD5 passwords in CVE-2025-30049, plaintext DB/RabbitMQ credentials readable by any local user in CVE-2025-30051), an IP-spoofing authentication bypass in the rsyncd service (CVE-2025-30052), unauthenticated cgm-updater network services (CVE-2025-30053/CVE-2025-58403), local privilege escalation via misconfigured HL7 processing permissions (CVE-2025-30054), and a reflected/stored XSS issue (CVE-2025-58403... actually CWE-79 listed separately).

Several of the most severe issues require only adjacent-network access (no authentication) to achieve remote code execution with root privileges, notably the HL7 communication processes (CVE-2025-30046) and the Java deserialization API (CVE-2025-30047), while others require low-privileged local access to escalate. The unauthenticated /DocManagment endpoint (CVE-2025-30043) directly exposes patient documents without any credentials, a significant privacy risk for healthcare operators. No in-the-wild exploitation has been reported; this is a coordinated vendor disclosure with fixes released across versions 2026.MS1 through 2026.MS4.

Defenders running CGM CLININET should update to 2026.MS4 or later as soon as possible, verify that administrative APIs, rsyncd, cgm-updater, and HL7 interfaces are not exposed to untrusted networks, rotate any credentials stored in SysIO.pl, and force a password reset given the weak MD5 hashing scheme. Network segmentation restricting adjacent-network access to clinical application servers is a key mitigating control pending patching.

## Mentioned in this report

- Vulnerabilities: CVE-2025-30043, CVE-2025-30045, CVE-2025-30046, CVE-2025-30047, CVE-2025-30049, CVE-2025-30050, CVE-2025-30051, CVE-2025-30052, CVE-2025-30053, CVE-2025-30054, CVE-2025-58403

Source reporting: https://cert.pl/en/posts/2026/10/CVE-2025-30043

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/0d4aa2fc-0c48-55b7-9db9-fb9eb4b75c89/cgm-clininet-patches-multiple-healthcare-rce-flaws.
In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out. Slack alerts on the vendors, sectors and countries a reader follows come with the paid plans too. A new account starts with a three-day trial, no card: https://vorant.io/signup