CGM CLININET up to 2026.MS3 ConvExpr code injection

Summaryinfo

A vulnerability was found in CGM CLININET up to 2026.MS3. It has been classified as very critical. The impacted element is the function ConvExpr. Performing a manipulation results in code injection. This vulnerability is cataloged as CVE-2025-30045. It is possible to initiate the attack remotely. There is no exploit available.

Detailsinfo

A vulnerability classified as very critical has been found in CGM CLININET up to 2026.MS3. This affects the function ConvExpr. The manipulation with an unknown input leads to a code injection vulnerability. CWE is classifying the issue as CWE-94. The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

CGM CLININET is vulnerable to Code Injection in the ConvExpr function, which processes Perl expressions into RTF document content. Due to improper control of the code evaluated from these expressions, an authenticated, high-privileged attacker can cause arbitrary code to be executed with root privileges.  The vulnerability was confirmed to affect versions up to 2026.MS3 but later versions may also be vulnerable.

It is possible to read the advisory at cert.pl. This vulnerability is uniquely identified as CVE-2025-30045 since 03/14/2025. The exploitability is told to be easy. It is possible to initiate the attack remotely. Additional levels of successful authentication are needed for exploitation. Technical details of the vulnerability are known, but there is no available exploit. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 10/23/2026). The attack technique deployed by this issue is T1059 according to MITRE ATT&CK.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2025-211176). Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Vendor

• CGM

Name

• CLININET

Version

• 2026.MS3

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion