CGM vulnerabilities
We track 22 vulnerabilities in CGM products across 3 products. 22 are rated high or critical, and none are known to be exploited. The most recent was published on October 23, 2026.
Latest CGM vulnerabilities
- 9.3 Critical severity
CGM CLININET: Incorrect Permission Assignment for Critical Resource
CGM CLININET is vulnerable to local privilege escalation. The service that processes incoming HL7 messages runs with root privileges, but due to incorrect permissions, its scripts and configuration files can be modified by the uhcapache user. An attacker with
- 8.8 High severity
CGM CLININET: Authentication Bypass by Spoofing
The rsyncd service of the CGM CLININET is vulnerable to Authentication Bypass via IP spoofing. Access is granted based solely on the client's source IP address. An attacker able to spoof an allowed IP address, can bypass this check and gain the ability to edit
- 9.4 Critical severity
CGM CLININET: Improper Control of Generation of Code
CGM CLININET is vulnerable to Code Injection in the RunCGI.pm component, which dynamically imports the module specified as a query parameter and executes code from untrusted data provided by the user. An attacker from adjacent network can supply a crafted quer
- 9.4 Critical severity
CGM CLININET: Deserialization of Untrusted Data
CGM CLININET is vulnerable to Remote Code Execution caused by deserialization of untrusted data. The server exposes an HTTP-based API, used by the administrative module, that exchanges data using Java object serialization. An attacker within the same local net
- 9.0 Critical severity
CGM CLININET: Execution with Unnecessary Privileges
In the CGM CLININET application server, multiple processes responsible for HL7 communication with external systems run with root privileges while processing untrusted data received from those external systems. An attacker in adjacent network able to send data
- 8.6 High severity
CGM CLININET: Improper Control of Generation of Code
CGM CLININET is vulnerable to Code Injection in the ConvExpr function, which processes Perl expressions into RTF document content. Due to improper control of the code evaluated from these expressions, an authenticated, high-privileged attacker can cause arbitr
- 7.1 High severity
CGM CLININET: Missing Authentication for Critical Functionality
CGM CLININET is vulnerable to Missing Authentication for Critical Function in the /DocManagment path. The endpoint is accessible without authentication, allowing an unauthenticated attacker in the adjacent network to retrieve the list of patient documents and
- 7.5 High severity
CGM CLININET: Authorization Bypass Through User-Controlled Key
The CGM CLININET application uses direct, sequential object identifiers "MessageID" without proper authorization checks. By modifying the parameter in the GET request, an attacker can access messages and attachments belonging to other users.
- 9.4 Critical severity
CGM CLININET: Improper Neutralization of Special Elements used in an OS Command
In the endpoints "/cgi-bin/CliniNET.prd/utils/usrlogstat_simple.pl", "/cgi-bin/CliniNET.prd/utils/usrlogstat.pl", "/cgi-bin/CliniNET.prd/utils/userlogstat2.pl", and "/cgi-bin/CliniNET.prd/utils/dblogstat.pl", the parameters are not sufficiently normalized, whi
- 7.8 High severity
CGM CLININET: Use of Client-Side Authentication
The CGM CLININET system provides smart card authentication; however, authentication is conducted locally on the client device, and, in reality, only the certificate number is used for access verification. As a result, possession of the certificate number alone
- 9.0 Critical severity
CGM CLININET: Missing Authentication for Critical Functionality
The vulnerability enables an attacker to fully bypass authentication in CGM CLININET and gain access to any active user account by supplying only the username, without requiring a password or any other credentials. Obtaining a session ID is sufficient for sess
- 8.8 High severity
CGM NETRAAD: Improper Neutralization of Special Elements used in an SQL Command
SQL Injection vulnerability in "imageserver" module when processing C-FIND queries in CGM NETRAAD software allows attacker connected to PACS gaining access to database, including data processed by GCM CLININET software.This issue affects CGM NETRAAD with image
- 8.8 High severity
CGM CLININET: Improper Verification of Cryptographic Signature
An insufficiently secured internal function allows session generation for arbitrary users. The decodeParam function checks the JWT but does not verify which signing algorithm was used. As a result, an attacker can use the "ex:action" parameter in the VerifyUse
- 9.4 Critical severity
CGM CLININET: Improper Control of Generation of Code
In UHCRTFDoc, the filename parameter can be exploited to execute arbitrary code via command injection into the system() call in the ConvertToPDF function.
- 9.4 Critical severity
CGM CLININET: Improper Control of Generation of Code
The RunCommand function accepts any parameter, which is then passed for execution in the shell. This allows an attacker to execute arbitrary code on the system.
- 9.0 Critical severity
CGM CLININET: Improper Control of Generation of Code
The "system" function receives untrusted input from the user. If the "EnableJSCaching" option is enabled, it is possible to execute arbitrary code provided as the "Module" parameter.
- 9.0 Critical severity
CGM CLININET: Missing Authentication for Critical Functionality
The paths "/cgi-bin/CliniNET.prd/utils/userlogstat.pl", "/cgi-bin/CliniNET.prd/utils/usrlogstat.pl", and "/cgi-bin/CliniNET.prd/utils/dblogstat.pl" expose data containing session IDs.
- 9.0 Critical severity
CGM CLININET: Missing Authentication for Critical Functionality
The vulnerability allows unauthenticated users to download a file containing session ID data by directly accessing the "/cgi-bin/CliniNET.prd/utils/userlogxls.pl" endpoint.
- 9.0 Critical severity
CGM CLININET: Missing Authentication for Critical Functionality
Unauthenticated access to the "/cgi-bin/CliniNET.prd/GetActiveSessions.pl" endpoint allows takeover of any user session logged into the system, including users with admin privileges.
- 7.3 High severity
CGM CLININET: Exposure of Sensitive Information Through Metadata
The vulnerability consists of a session ID leak when saving a file downloaded from CGM CLININET. The identifier is exposed through a built-in Windows security feature that stores additional metadata in an NTFS alternate data stream (ADS) for all files download
- 8.8 High severity
CGM CLININET: Missing Authentication for Critical Functionality
The system exposes several endpoints, typically including "/int/" in their path, that should be restricted to internal services, but are instead publicly accessible without authentication to any host able to reach the application server on port 443/tcp.
- 8.8 High severity
CGM CLININET: Improper Neutralization of Input During Web Page Generation
Stored XSS vulnerability exists in the "Oddział" (Ward) module, in the death diagnosis description field, and allows the execution of arbitrary JavaScript code. This can lead to session hijacking of other users and potentially to privilege escalation up to ful