CGM CLININET runs a service that processes HL7 messages under the root privilege. An attacker who can run as the uhcapache user can modify scripts and configuration files because they have improper permissions. By changing these files, the attacker can execute arbitrary code with root privileges, effectively escalating local privileges. The flaw represents a classic case of incorrect permission assignment (CWE‑732) and carries the potential for complete system compromise.

The vulnerability has been confirmed on CGM CLININET versions up to 2026.MS3. Later versions may also be affected although not yet verified. The product is produced by CGM and sells the CLININET line for hospital use.

The high CVSS score of 9.3 indicates a severe security risk. Exploitation requires local access with uhcapache privileges, so an attacker must first gain a foothold on the host. Because EPSS is not available and the vulnerability is not listed in CISA’s KEV catalog, the likelihood of exploitation depends on attacker persistence, but the potential impact justifies immediate attention. Once exploited, the attacker can run code as root.