PT-2026-22574 · Unknown · Cgm Clininet System

Maciej Kazulak · Published 2026-03-02 · Updated 2026-03-09 · CVE-2025-30042

Positive Technologies (AI Summary)

CVSS v4.0

9.0

Critical

Base vector

AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Name of the Vulnerable Software and Affected Versions CGM CLININET system (affected versions not specified)

Description The CGM CLININET system uses smart card authentication, but authentication happens locally on the client device. Instead of verifying the smart card and private key, only the certificate number is used for access verification. This means that possessing the certificate number is enough to authenticate, even without the smart card or the correct private key.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-603

Related Identifiers

CVE-2025-30042

Affected Products

Cgm Clininet System

References · 10

• https://osv.dev/vulnerability/CVE-2025-30042 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-30042 · Security Note
• https://twitter.com/CVEnew/status/2028437082184765696 · Twitter Post
• https://t.me/CVEtracker/46111 · Telegram Post
• https://twitter.com/infoflowcloud/status/2028439258961228028 · Twitter Post
• https://cgm.com/pol_pl/products/szpital/cgm-clininet.html · Note
• https://twitter.com/dailycve/status/2031118135462424700 · Twitter Post
• https://t.me/cveNotify/154826 · Telegram Post
• https://t.me/cveNotify/153711 · Telegram Post
• https://cert.pl/en/posts/2026/03/CVE-2025-10350 · Note