PT-2026-22572 · Unknown+1 · Gcm Clininet+1

Maciej Kazulak · Published 2026-03-02 · Updated 2026-03-09 · CVE-2025-10350

Positive Technologies (AI Summary)

CVSS v4.0

8.8

High

Base vector

AV:A/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L

Name of the Vulnerable Software and Affected Versions CGM NETRAAD versions prior to 7.9.0

Description A SQL Injection issue exists in the "imageserver" module when processing C-FIND queries. This affects CGM NETRAAD software and potentially allows an attacker connected to a PACS system to gain access to the database, including data processed by GCM CLININET software. The issue is present when processing C-FIND queries via the imageserver module. The API endpoint involved is not specified. The vulnerable parameter is not specified.

Recommendations Update CGM NETRAAD to version 7.9.0 or later.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2025-10350

Affected Products

Cgm Netraad

Gcm Clininet

References · 16

• https://nvd.nist.gov/vuln/detail/CVE-2025-10350 · Security Note
• https://t.me/cveNotify/153710 · Telegram Post
• https://t.me/cveNotify/153709 · Telegram Post
• https://t.me/CVEtracker/46109 · Telegram Post
• https://t.me/cveNotify/153714 · Telegram Post
• https://t.me/cveNotify/153712 · Telegram Post
• https://t.me/cveNotify/154812 · Telegram Post
• https://t.me/cveNotify/154810 · Telegram Post
• https://t.me/cveNotify/154826 · Telegram Post
• https://cgm.com/pol_pl/products/szpital/cgm-netraad.html · Note
• https://t.me/cveNotify/153711 · Telegram Post
• https://t.me/cveNotify/153713 · Telegram Post
• https://t.me/cveNotify/154811 · Telegram Post
• https://cert.pl/en/posts/2026/03/CVE-2025-10350 · Note
• https://twitter.com/CVEnew/status/2028437083929624736 · Twitter Post