CVE-2025-30044: RCE on uhcapache user permissions

Severity: critical (CVSS 9.4 v4.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-03-02 · updated 2026-06-17
Weakness: CWE-78

Description

In the endpoints "/cgi-bin/CliniNET.prd/utils/usrlogstat_simple.pl", "/cgi-bin/CliniNET.prd/utils/usrlogstat.pl", "/cgi-bin/CliniNET.prd/utils/userlogstat2.pl", and "/cgi-bin/CliniNET.prd/utils/dblogstat.pl", the parameters are not sufficiently normalized, which enables code injection.

Affected products

CGM CLININET: before 2025.MS2 — fixed in 2025.MS2

How to fix

Upgrade to a fixed version: CGM CLININET 2025.MS2. Check the vendor advisory for mitigations.

References

https://cert.pl/en/posts/2026/03/CVE-2025-10350/
https://www.cgm.com/pol_pl/products/szpital/cgm-clininet.html

Get alerted when CVE-2025-30044 or the next vulnerability affects your stack