CVE-2025-30050Critical· 9.4▾ MidnightCGM CLININET is vulnerable to Code Injection in the RunCGI.pm component, which dynamically imports the module specified as a query parameter and executes code from untrusted data provided by the user. An attacker from adjacent network ca…
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 51.7 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
CGM CLININET is vulnerable to Code Injection in the RunCGI.pm component, which dynamically imports the module specified as a query parameter and executes code from untrusted data provided by the user. An attacker from adjacent network can supply a crafted query parameter to have an attacker-controlled module imported which results in arbitrary code execution with root privileges.
This issue was fixed in version 2026.MS3
clininet < 2026.MS3Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2025-30045High· 8.6Code Injection in CGM CLININET
CVE-2025-30046Critical· 9.0Remote Code Execution in CGM CLININET
CVE-2025-30049High· 8.2Use of Unsalted MD5 Password Hashes in CGM CLININET
CVE-2025-30043High· 7.1Missing Authentication in CGM CLININET
CVE-2025-30047Critical· 9.4Remote Code Execution via Java Deserialization in CGM CLININET
CVE-2025-30052High· 8.8Authentication Bypass via IP Spoofing in CGM CLININET rsyncd