Zero Radar
← feed
CriticalVulnerabilityCVE-2025-30054updated 25 Oct 2026, 17:05 UTC

CGM CLININET: local user can gain root control via writable service files

A user account with low privileges on a CGM CLININET system can change files that a root-level service reads and runs. That lets them take full control of the machine.

Official, 2 sources
SeverityCriticalCVSS 9.3 of 10
Being exploited?UnclearNo reports either way yet
Fix available?UnclearNo fixed version published in the sources yet
How sure is this?Official, 2 sourcesBacked by an official source

How the attack works simplified

  1. 1Local low-privilege userNeeds uhcapache account access
  2. 2Modify service filesScripts and config are writable by uhcapache
  3. 3HL7 service runsService runs with root privileges
  4. 4Malicious code executesCode runs as root
  5. ResultAttacker gains root control of the system

What happened

The HL7 message-processing service runs as root, but its scripts and configuration files have incorrect permissions that allow the uhcapache user to modify them, enabling arbitrary code execution as root (local privilege escalation).

Why it is dangerous: An attacker or malicious insider who already has uhcapache access can gain full administrative control of the system, which may hold sensitive clinical data and disrupt patient-related services.

Are you affected?

You are affected if you run CGM CLININET up to version 2026.MS3 (later versions may also be vulnerable) with the HL7 message service and uhcapache accounts present on the system.

CGM CLININET up to and including 2026.MS3; later versions possibly affected (unconfirmed).

What to do

  1. Check with CGM or your vendor for a patched CLININET release and apply it as soon as available
  2. Restrict local logon and access to the uhcapache account and limit who can reach the server
  3. Review file permissions on the HL7 service scripts and configuration files, and make them writable only by root
  4. Monitor the system for unexpected changes to service scripts and configuration files

Timeline

  1. 23 Oct 2026, 09:17 UTC
    Publicly disclosed
  2. 23 Oct 2026, 09:17 UTC
    Reported by NVD · NVD
  3. 25 Oct 2026, 17:05 UTC
    GitHub Advisory reported on it · GitHub Advisory

Sources 2 reports, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2025-30054 · GHSA-xr4f-2f7f-gcx6
CVSS
9.3 / 10
EPSS
0.1% chance of exploitation within 30 days
Disclosed
23 Oct 2026, 09:17 UTC
On Zero Radar
before the radar started
Last change
25 Oct 2026, 17:05 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

CGM CLININET: local user can gain root control via writable service files · Zero Radar