CGM CLININET is vulnerable to Reflected Cross-Site Scripting (XSS) due to improper neutralization of user-supplied data. A remote unauthenticated attacker can craft a malicious URL containing JavaScript or HTML code, which is executed in the victim's browser when the URL is visited, allowing the attacker to steal session cookies and perform actions on behalf of the victim within the application.
The vulnerability was confirmed to affect versions up to 2026.MS3 but later versions may also be vulnerable.
CGM CLININET contains a local privilege escalation vulnerability (CVE-2025-30054) due to incorrect permission assignments on scripts and configuration files used by a root-privileged service processing HL7 messages. An attacker with uhcapache user privileges can modify these files to execute arbitrary code as root. Versions up to 2026.MS3 are confirmed vulnerable. A patch is available. The vulnerability has a critical CVSS 4.0 score of 9.3.
CVE-2025-30053 is a vulnerability in the CGM CLININET application where the cgm-updater process listens on an open network port without any authentication. This missing authentication for a critical function allows unauthenticated network access. The vulnerability affects versions up to 2026.MS3. The CVSS 4.0 base score is 6.9, indicating a medium severity level.
CVE-2025-30052 is an authentication bypass vulnerability in the rsyncd service of CGM CLININET. The service grants access based solely on the client's source IP address, allowing an attacker who can spoof an allowed IP to bypass authentication and edit files on the system. This affects versions up to 2026.MS3. The vulnerability has a high severity with a CVSS score of 8.8. A patch is available, and the product is a cloud service with vendor-managed remediation.
CVE-2025-30051 is a vulnerability in the CGM CLININET application where critical credentials, including the production database login and RabbitMQ broker credentials, are stored in the SysIO.pl configuration file with insecure file permissions. This misconfiguration allows any local user to read the file, potentially exposing sensitive credentials. The issue was fixed in version 2026.MS3.
CGM CLININET contains a critical code injection vulnerability in its RunCGI.pm component. This flaw allows an attacker on an adjacent network to supply a crafted query parameter that causes the import and execution of an attacker-controlled module with root privileges. The vulnerability is fixed in version 2026.MS3.
CGM CLININET versions prior to 2026.MS1 and 2026.MS3 store user passwords as unsalted MD5 hashes, which use insufficient computational effort for password hashing. This vulnerability has a high severity score of 8.2 and was addressed in versions 2026.MS1 and 2026.MS3.
CGM CLININET contains a critical vulnerability (CVE-2025-30047) involving deserialization of untrusted data in its HTTP-based API used by the administrative module. An attacker on the same local network can send crafted serialized Java objects that, when deserialized by the server, lead to remote code execution with root privileges. This vulnerability is fixed in version 2026.MS3.
CVE-2025-30046 is a critical vulnerability in the CGM CLININET application server where HL7 communication processes run with root privileges while handling untrusted data. This allows an attacker on an adjacent network to send malicious data to these processes and achieve remote code execution with root privileges. The vulnerability affects versions up to 2026.MS3. A patch is available, and the product is a cloud service with vendor-managed remediation.
CGM CLININET contains a code injection vulnerability in its ConvExpr function that processes Perl expressions into RTF document content. This flaw allows an authenticated attacker with high privileges to execute arbitrary code with root privileges. The vulnerability affects versions up to and including 2026.MS3. A patch is available, and the product is a cloud service where the vendor manages remediation.
CGM CLININET has a vulnerability (CVE-2025-30043) involving missing authentication on the /DocManagment endpoint. This allows unauthenticated attackers on adjacent networks to access and download patient documents. The issue is fixed in version 2026.MS3. The vulnerability has a high severity score of 7.1 and affects versions prior to 2026.MS3.
The CGM CLININET application respond without essential security HTTP headers, exposing users to client‑side attacks such as clickjacking, MIME sniffing, unsafe caching, weak cross‑origin isolation, and missing transport security controls.
The CGM CLININET application does not implement any mechanisms that prevent clickjacking attacks, neither HTTP security headers nor HTML-based frame‑busting protections were detected. As a result, an attacker can embed the application inside a maliciously crafted IFRAME and trick users into performing unintended actions, including potentially bypassing CSRF/XSRF defenses.
The CGM CLININET application uses direct, sequential object identifiers "MessageID" without proper authorization checks. By modifying the parameter in the GET request, an attacker can access messages and attachments belonging to other users.
In the endpoints "/cgi-bin/CliniNET.prd/utils/usrlogstat_simple.pl", "/cgi-bin/CliniNET.prd/utils/usrlogstat.pl", "/cgi-bin/CliniNET.prd/utils/userlogstat2.pl", and "/cgi-bin/CliniNET.prd/utils/dblogstat.pl", the parameters are not sufficiently normalized, which enables code injection.
The CGM CLININET system provides smart card authentication; however, authentication is conducted locally on the client device, and, in reality, only the certificate number is used for access verification. As a result, possession of the certificate number alone is sufficient for authentication, regardless of the actual presence of the smart card or ownership of the private key.
The vulnerability enables an attacker to fully bypass authentication in CGM CLININET and gain access to any active user account by supplying only the username, without requiring a password or any other credentials. Obtaining a session ID is sufficient for session takeover and grants access to the system with the privileges of the targeted user.
SQL Injection vulnerability in "imageserver" module when processing C-FIND queries in CGM NETRAAD software allows attacker connected to PACS gaining access to database, including data processed by GCM CLININET software.This issue affects CGM NETRAAD with imageserver module in versions before 7.9.0.
An insufficiently secured internal function allows session generation for arbitrary users. The decodeParam function checks the JWT but does not verify which signing algorithm was used. As a result, an attacker can use the "ex:action" parameter in the VerifyUserByThrustedService function to generate a session for any user.
