CVE-2025-30042 — Session generation possible with certificate number only
The CGM CLININET system provides smart card authentication; however, authentication is conducted locally on the client device, and, in reality, only the certificate number is us…
Published: 2026-03-02 · CVSS: 9.0 · CVSS 4.0
The CGM CLININET system provides smart card authentication; however, authentication is conducted locally on the client device, and, in reality, only the certificate number is used for access verification. As a result, possession of the certificate number alone is sufficient for authentication, regardless of the actual presence of the smart card or ownership of the private key.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7