Description (CNA)
The CGM CLININET system provides smart card authentication; however, authentication is conducted locally on the client device, and, in reality, only the certificate number is used for access verification. As a result, possession of the certificate number alone is sufficient for authentication, regardless of the actual presence of the smart card or ownership of the private key.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| CGM / CGM CLININET | affected 0 before 2025.MS2 |
CWE
CWE-603
References
- https://cert.pl/en/posts/2026/03/CVE-2025-10350/
- https://www.cgm.com/pol_pl/products/szpital/cgm-clininet.html
ADP enrichment
No English description supplied.
No references supplied.