Vulnerability · Published Mar 2, 2026 · Assigned by CERT-PL

CVE-2025-30042Session generation possible with certificate number only

Critical 9.0

In plain English

A critical-severity security flaw in CGM CLININET from CGM. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 1% of all known vulnerabilities).

Severity (CVSS 4.0)9.0Critical

Exploit odds (30 days)<0.1%top 99.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

The CGM CLININET system provides smart card authentication; however, authentication is conducted locally on the client device, and, in reality, only the certificate number is used for access verification. As a result, possession of the certificate number alone is sufficient for authentication, regardless of the actual presence of the smart card or ownership of the private key.

Affected products (as reported)

Vendor	Product	Versions
CGM	CGM CLININET	0 – before 2025.MS2

Weakness: CWE-603 · Vector: CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

References

https://cert.pl/en/posts/2026/03/CVE-2025-10350/ third-party-advisory
https://www.cgm.com/pol_pl/products/szpital/cgm-clininet.html product