CVE-2025-30042: Session generation possible with certificate number only

Severity: high (CVSS 7.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-03-02 · updated 2026-06-17
Weakness: CWE-603

Description

The CGM CLININET system provides smart card authentication; however, authentication is conducted locally on the client device, and, in reality, only the certificate number is used for access verification. As a result, possession of the certificate number alone is sufficient for authentication, regardless of the actual presence of the smart card or ownership of the private key.

Affected products

CGM CLININET: before 2025.ms2 — fixed in 2025.ms2

How to fix

Upgrade to a fixed version: CGM CLININET 2025.ms2. Check the vendor advisory for mitigations.

References

https://cert.pl/en/posts/2026/03/CVE-2025-10350/
https://www.cgm.com/pol_pl/products/szpital/cgm-clininet.html

Get alerted when CVE-2025-30042 or the next vulnerability affects your stack