Auth bypass in Cgm Clininet
CVE-2025-30035
The vulnerability enables an attacker to fully bypass authentication in CGM CLININET and gain access to any active user account by supplying only the username, without requiring a password or any other credentials. Obtaining a session ID is sufficient for session takeover and grants access to the system with the privileges of the targeted user.
Vulnerability class: Broken Authentication
EPSS: 0.002 (10.8th percentile) — read the EPSS interpretation.
Affected products
- Cgm Clininet — versions 0
Weakness classification (CWE)
References
- cvd@cert.pl (third-party-advisory)
- cvd@cert.pl (product)