CVE-2025-30045 in CLININET
Summary
by MITRE • 10/23/2026
CGM CLININET is vulnerable to Code Injection in the ConvExpr function, which processes Perl expressions into RTF document content. Due to improper control of the code evaluated from these expressions, an authenticated, high-privileged attacker can cause arbitrary code to be executed with root privileges.
The vulnerability was confirmed to affect versions up to 2026.MS3 but later versions may also be vulnerable.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/23/2026
CGM Clinet is a widely deployed clinical information system used in healthcare environments to manage patient data, laboratory results, and medical workflows. The software relies on Perl-based scripting for various internal functions, including the generation of Rich Text Format documents through its ConvExpr function. This specific component is designed to evaluate Perl expressions provided by users or administrators to dynamically generate document content. However, a critical security flaw exists in how this function handles input validation and execution context. Because the system fails to properly sanitize or restrict the scope of code evaluated from these expressions, it creates an avenue for arbitrary command injection. This vulnerability allows attackers who have obtained valid authentication credentials with high-level privileges to inject malicious Perl code that is then executed by the application process itself.
The technical nature of this flaw centers on improper control over user-supplied input within a dynamic evaluation context. When the ConvExpr function processes a request, it interprets the provided string as executable Perl code without sufficient safeguards against command execution or system-level interactions. In many legacy and specialized enterprise applications, such functions are often used for report generation or data formatting where complex expressions might be necessary. However, when these inputs are not strictly validated to ensure they only contain safe, non-executable characters or allowed operations, the boundary between data processing and code execution blurs. An attacker leveraging this weakness can craft a specially formatted expression that invokes system commands, reads sensitive files, or modifies application state directly on the server hosting Clinet.
The operational impact of this vulnerability is severe due to the privilege level at which it operates. Since the underlying Perl script typically runs with elevated permissions necessary for database access and file management within the clinical environment, successful exploitation results in arbitrary code execution with root privileges. This means an attacker gains full control over the affected server. In a healthcare setting, such compromise can lead to the exfiltration of protected health information, alteration or deletion of critical patient records, disruption of medical services, and potential lateral movement into other parts of the hospital network. The fact that authentication is required limits the attack surface compared to remote unauthenticated exploits but does not mitigate the severity for insider threats or compromised administrative accounts which are common vectors in healthcare IT environments.
Mitigation strategies must address both immediate remediation and long-term architectural improvements. Organizations running CGM Clinet should immediately apply any available patches from the vendor, noting that while versions up to 2026.MS3 were confirmed vulnerable, later versions may also be at risk until a definitive fix is released by the manufacturer. In the interim, access controls must be strictly enforced to ensure that only essential personnel have high-privileged accounts capable of invoking these functions. Network segmentation should isolate clinical systems from general corporate networks to limit lateral movement in case of compromise. Additionally, input validation mechanisms should be implemented at the application layer to restrict the types of expressions allowed in document generation modules, ensuring that dynamic code evaluation is either disabled if not strictly required or sandboxed to prevent system-level access.
From a classification perspective, this vulnerability aligns with CWE-94 Improper Control of Generation of Code (Code Injection), specifically where user input influences executable code without proper validation. It also maps to MITRE ATT&CK techniques related to Command and Scripting Interpreter abuse, particularly T1059 which covers execution via scripting interpreters like Perl or Python within enterprise applications. Understanding these mappings helps security teams prioritize detection rules and incident response procedures tailored to this specific type of application-layer exploitation. Continuous monitoring for unusual process executions originating from the Clinet service account can aid in early detection of such attacks before significant damage occurs.