Remote Code Execution in CGM CLININET
- Published
- Last modified
- Status
- published
- Known exploitation
- Not listed in CISA KEV
- Public exploit
- None on Exploit-DB
Summary
CGM CLININET, a clinical software product, is affected by a flaw in its RunCGI.pm component that allows an attacker on an adjacent network to run arbitrary code with root privileges by sending a specially crafted request. This could give the attacker full control over the affected system.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
CGM CLININET is vulnerable to Code Injection in the RunCGI.pm component, which dynamically imports the module specified as a query parameter and executes code from untrusted data provided by the user. An attacker from adjacent network can supply a crafted query parameter to have an attacker-controlled module imported which results in arbitrary code execution with root privileges. This issue was fixed in version 2026.MS3
Affected versions
- CGM CGM CLININET
fixed in 2026.MS3