---
id: CVE-2025-30054
title: Local Privilege Escalation in CGM CLININET
summary: >-
  CGM CLININET is vulnerable to local privilege escalation. The service that
  processes incoming HL7 messages runs with root privileges, but due to
  incorrect permissions, its scripts and configuration files can be modified by
  the uhcapache …
severity: critical
cvss: 9.3
cvssVector: 'CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H'
cvssSource: cna
cwe:
  - CWE-732
vendor: CGM
product: CGM CLININET
affected:
  - clininet <= 2026.MS3
published: '2026-10-23'
updated: '2026-10-23'
sourceUpdated: '2026-10-23T08:22:59.749Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2025-30054'
references:
  - url: 'https://cert.pl/en/posts/2026/10/CVE-2025-30043/'
  - url: 'https://www.cgm.com/pol_pl/products/szpital/cgm-clininet.html'
tags:
  - cve.org
ingestedAt: '2026-10-23T09:20:44.060Z'
---

## Overview

CGM CLININET is vulnerable to local privilege escalation. The service that processes incoming HL7 messages runs with root privileges, but due to incorrect permissions, its scripts and configuration files can be modified by the uhcapache user. An attacker with uhcapache privileges can modify these files to execute arbitrary code as root.


The vulnerability was confirmed to affect versions up to 2026.MS3 but later versions may also be vulnerable.

## Affected

- `clininet <= 2026.MS3`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.