CVE-2025-30050

CGM CLININET is vulnerable to local privilege escalation. The service processing incoming HL7 messages runs with root privileges, but due to incorrect permissions its scripts and configuration files can be modified by the uhcapache user, allowing execution of arbitrary code as root.

CGM CLININET is vulnerable to remote code execution caused by deserialization of untrusted data. The server exposes an HTTP-based API used by the administrative module that exchanges data using Java object serialization; an attacker on the same local network can send a crafted serialized object whose deserialization allows arbitrary code execution with root privileges.

In the CGM CLININET application server, multiple processes responsible for HL7 communication with external systems run with root privileges while processing untrusted data received from those systems. An attacker on an adjacent network able to send data to these HL7 processes can achieve remote code execution with root privileges.

In the endpoints "/cgi-bin/CliniNET.prd/utils/usrlogstat_simple.pl", "/cgi-bin/CliniNET.prd/utils/usrlogstat.pl", "/cgi-bin/CliniNET.prd/utils/userlogstat2.pl", and "/cgi-bin/CliniNET.prd/utils/dblogstat.pl", the parameters are not sufficiently normalized, which enables code injection.

The vulnerability enables an attacker to fully bypass authentication in CGM CLININET and gain access to any active user account by supplying only the username, without requiring a password or any other credentials. Obtaining a session ID is sufficient for session takeover and grants access to the system with the privileges of the targeted user.

CGM CLININET is vulnerable to Reflected Cross-Site Scripting (XSS) due to improper neutralization of user-supplied data. A remote unauthenticated attacker can craft a malicious URL containing JavaScript or HTML code that executes in the victim's browser when visited, allowing theft of session cookies and actions performed on behalf of the victim within the application.

The CGM CLININET application runs the cgm-updater process listening on an open network port without any authentication. The vulnerability was confirmed to affect versions up to 2026.MS3; version 2026.MS3 with the updater-upkg component in version 5.3.0 or higher is not affected.

The rsyncd service of CGM CLININET is vulnerable to Authentication Bypass via IP spoofing. Access is granted solely based on the client's source IP address, so an attacker able to spoof an allowed IP can edit files on the affected system.

The CGM CLININET application stores the production database login and password, as well as RabbitMQ broker credentials, in the SysIO.pl configuration file. Insecure file permissions make this file readable by any local account.

The CGM CLININET application stores user passwords as unsalted MD5 hashes. This storage method is vulnerable to dictionary and rainbow table attacks in the event of a database breach.