CVE-2025-58406

The CGM CLININET application respond without essential security HTTP headers, exposing users to client‑side attacks such as clickjacking, MIME sniffing, unsafe caching, weak cross‑origin isolation, and missing transport security controls.

CVSS v3 4.3 MEDIUM

4.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://cert.pl/en/posts/2026/03/CVE-2025-10350/	Third Party Advisory
https://www.cgm.com/pol_pl/products/szpital/cgm-clininet.html	Product

Configurations

Configuration 1 (hide)

cpe:2.3:a:cgm:clininet:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2026-03-02 12:16

Updated : 2026-03-09 15:11

NVD link : CVE-2025-58406

Mitre link : CVE-2025-58406

CVE.ORG link : CVE-2025-58406

JSON object : View

Products Affected

cgm

clininet

CWE

CWE-693

Protection Mechanism Failure

{"id": "CVE-2025-58406", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 2.8}], "cvssMetricV40": [{"type": "Secondary", "source": "cvd@cert.pl", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 5.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "published": "2026-03-02T12:16:01.923", "references": [{"url": "https://cert.pl/en/posts/2026/03/CVE-2025-10350/", "tags": ["Third Party Advisory"], "source": "cvd@cert.pl"}, {"url": "https://www.cgm.com/pol_pl/products/szpital/cgm-clininet.html", "tags": ["Product"], "source": "cvd@cert.pl"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "cvd@cert.pl", "description": [{"lang": "en", "value": "CWE-693"}]}], "descriptions": [{"lang": "en", "value": "The CGM CLININET application respond without essential security HTTP headers, exposing users to client\u2011side attacks such as clickjacking, MIME sniffing, unsafe caching, weak cross\u2011origin isolation, and missing transport security controls."}, {"lang": "es", "value": "La aplicaci\u00f3n CGM CLININET responde sin encabezados HTTP de seguridad esenciales, exponiendo a los usuarios a ataques del lado del cliente como clickjacking, rastreo de MIME, almacenamiento en cach\u00e9 inseguro, aislamiento de origen cruzado d\u00e9bil y controles de seguridad de transporte ausentes."}], "lastModified": "2026-03-09T15:11:00.580", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:cgm:clininet:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BBCA0F7E-EF98-41DF-A128-0D733443D02C", "versionEndExcluding": "2025.ms3"}], "operator": "OR"}]}], "sourceIdentifier": "cvd@cert.pl"}