by Kastro
Paper/Archive/CVE-2025-30056

CVE-2025-30056

CGM CGM CLININET — Calling system commands via RunCommand

EPSS 0.2%CVSS 9.4
critical.is priorityof 100
31
CVSS 9.4 (CNA)9.4 / 10 × 3028.2Not in CISA KEV+300.0EPSS percentile 14.2.142 × 202.8No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

The RunCommand function accepts any parameter, which is then passed for execution in the shell. This allows an attacker to execute arbitrary code on the system.

Affected

ProductAffectedFixed inSource
CGM CLININET< 2024.MS4.332024.MS4.33CNA

Scores by source

CERT-PL (CNA)9.4CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refcert.pl/en/posts/2025/08/CVE-2025-2313