CVE-2025-30042: Session generation possible with certificate number only
The CGM CLININET system provides smart card authentication; however, authentication is conducted locally on the client device, and, in reality, only the certificate number is used for access verification. As a result, possession of the certificate number alone is sufficient for authentication, regardless of the actual presence of the smart card or ownership of the private key.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-30042?
CVE-2025-30042 is considered a critical vulnerability due to its potential for unauthorized access.
How do I fix CVE-2025-30042?
To fix CVE-2025-30042, update the CGM CLININET system to the latest version that addresses this authentication flaw.
What type of attack does CVE-2025-30042 facilitate?
CVE-2025-30042 facilitates unauthorized access through weak authentication based solely on certificate numbers.
Which systems are affected by CVE-2025-30042?
CVE-2025-30042 affects the CGM CLININET system that utilizes smart card authentication.
What kind of authentication issue is related to CVE-2025-30042?
CVE-2025-30042 is related to local client-side authentication that relies only on the certificate number.