CVE-2025-30042
Cgm Clininet ≤ 2025.ms2
Raw vector
CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XSummary
CVE-2025-30042 is a critical-severity Use of Client-Side Authentication (CWE-603) vulnerability in Cgm Clininet. Its CVSS base score is 9.0 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 0.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to AC-3 (Access Enforcement) and IA-2 (Identification and Authentication (Organizational Users)) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2025-30042 is a vulnerability in the CGM CLININET system, which implements smart card authentication for access control. The authentication process is performed locally on the client device and verifies access using only the certificate number, rather than requiring the physical smart card or the associated private key. As a result, knowledge of the certificate number alone suffices for successful authentication. The issue carries a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and maps to CWE-603.
A local attacker with low privileges (PR:L) on the affected client device can exploit this vulnerability with low complexity and no user interaction. By acquiring the certificate number, the attacker can bypass proper smart card authentication, gaining unauthorized access to the CGM CLININET system and achieving high impacts on confidentiality, integrity, and availability.
Advisories and product information related to mitigation are available from CERT.PL at https://cert.pl/en/posts/2026/03/CVE-2025-10350/ and the CGM CLININET product page at https://www.cgm.com/pol_pl/products/szpital/cgm-clininet.html. The vulnerability was published on 2026-03-02T12:16:01.087.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-208147
- 🇵🇱 CERT-PL: cert.pl
Vulnerability Data
The CGM CLININET system provides smart card authentication; however, authentication is conducted locally on the client device, and, in reality, only the certificate number is used for access verification. As a result, possession of the certificate number alone is sufficient…
more
for authentication, regardless of the actual presence of the smart card or ownership of the private key.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V10.4.10V10.4.15V10.4.16V10.7.1
Mitigating Controls (NIST 800-53 r5) AI
Enforces access authorizations on the server, making client-side bypass ineffective.
Requires server-side identification and authentication of users before granting access.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Server-enforced authentication directly prevents client-only checks from being bypassed.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Requires server-side authentication mechanisms that directly prevent client-only checks.
Promotes secure architecture principles that reject client-only authentication designs.
Security testing can detect missing server-side authentication checks.
Defines application security requirements that include server-side authentication enforcement.
Secure coding standards discourage reliance on client-side authentication logic.
Enforces access restrictions that must be validated on the server, mitigating client-side bypass.