CVE-2025-30056 CRITICAL

CVE-2025-30056: Calling system commands via RunCommand

Vendor Cgm

Product CGM CLININET

Weakness CWE-94 · Code injection

Published August 27, 2025

Last update August 27, 2025

View on NVD All CVEs

CVSS base score

9.4/10

Attack vector Adjacent

Attack complexity Low

Privileges required None

User interaction None

Confidentiality —

Integrity —

CVSS vector

CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

What the vulnerability does

01Description

The RunCommand function accepts any parameter, which is then passed for execution in the shell. This allows an attacker to execute arbitrary code on the system.

Key dates

02Disclosure timeline

August 27, 2025 CVE published

August 27, 2025 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2025-30056 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/94.html