CVE-2025-30056
Calling system commands via RunCommand
- State
- Published
- Severity
- 9.4 Critical
- Published
- Aug 27, 2025
- Updated
- Aug 27, 2025
- Reserved
- Mar 14, 2025
Description
The RunCommand function accepts any parameter, which is then passed for execution in the shell. This allows an attacker to execute arbitrary code on the system.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 9.4 Critical | CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H | CERT-PL |
Weaknesses
- CWE-94 Improper Control of Generation of Code ('Code Injection')
Affected Products
| Product | Versions |
|---|---|
CGM CLININETCGM |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.