CGM CLININET Smart Card Authentication Vulnerability Allowing Certificate Number-Based Access

A vulnerability exists in the CGM CLININET system's smart card authentication process. Authentication is performed locally on the client device, relying solely on the certificate number for access verification. This flaw allows possession of the certificate number alone to suffice for authentication, regardless of the actual presence of the smart card or ownership of the private key. The vulnerability affects all versions of CGM CLININET prior to 2025.MS2.

Impact

Exploitation of this vulnerability allows for unauthorized access to the system, bypassing smart card authentication and enabling access to user accounts based solely on the certificate number.