CVE-2025-30035
CriticalSummary
The vulnerability enables an attacker to fully bypass authentication in CGM CLININET and gain access to any active user account by supplying only the username, without requiring a password or any other credentials. Obtaining a session ID is sufficient for session takeover and grants access to the system with the privileges of the targeted user.
Risk Assessment
The risk involves potential unauthorized access to the system and account takeover, which could lead to compromise of confidentiality and integrity of medical data.
Recommendation
It is recommended to immediately apply vendor-provided patches and implement additional authentication mechanisms such as MFA.
Original NVD description (English source)
The vulnerability enables an attacker to fully bypass authentication in CGM CLININET and gain access to any active user account by supplying only the username, without requiring a password or any other credentials. Obtaining a session ID is sufficient for session takeover and grants access to the system with the privileges of the targeted user.