CGM CLININET software includes a RunCGI.pm component that dynamically loads a module based on a query parameter supplied by the user. The component executes code from this module without validating the source, allowing an attacker to supply a crafted parameter that causes an attacker‑controlled module to be imported and run with root privileges. This flaw provides complete arbitrary code execution to anyone able to reach the interface, effectively turning the system into a vulnerable target for high‑impact attacks.

The vulnerable product is CGM CLININET. All versions released prior to 2026.MS3 contain the flaw; the issue was addressed in the 2026.MS3 release. Therefore any deployment of CGM CLININET not upgraded to 2026.MS3 or later is affected.

The CVSS score of 9.4 signifies critical severity, and while an EPSS score is not available, the reported attack vector is an adjacent network, indicating that an attacker who can reach the CGI endpoint can exploit the flaw. The flaw is not listed in CISA’s KEV catalog, but its high severity and the ability to gain root privileges emphasize the need for rapid remediation. The vulnerability is exploited by sending a specially crafted request that sets the query parameter to point to a malicious module, which the RunCGI.pm component then loads and executes.