CVE-2025-30042

Smart card authentication in the CGM CLININET system is performed locally on the client device, and access verification is based solely on the certificate number. In practice, the system does not verify either the actual presence of the smart card or the possession of the corresponding private key. This means that a person who knows another user's certificate number can impersonate them and gain access to the system without any additional authentication component.

An attacker possessing the certificate number of any user can gain full unauthorized access to the CGM CLININET system with that user's privileges, which in a medical environment poses a risk of disclosure, modification, or deletion of sensitive patient data as well as disruption of hospital system continuity.

Patches available from the manufacturer should be applied in accordance with the references. Additionally, it is recommended to verify that the authentication process has been moved to the server side and includes cryptographic confirmation of private key possession (e.g., via a challenge-response mechanism), rather than merely checking the certificate number.

CGM CLININET system — versions indicated in the manufacturer's references