CVE-2025-58406

The CGM CLININET application respond without essential security HTTP headers, exposing users to client‑side attacks such as clickjacking, MIME sniffing, unsafe caching, weak cross‑origin isolation, and missing transport security controls.

CVSS v3 4.3 MEDIUM

4.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://cert.pl/en/posts/2026/03/CVE-2025-10350/	Third Party Advisory
https://www.cgm.com/pol_pl/products/szpital/cgm-clininet.html	Product

Configurations

Configuration 1 (hide)

cpe:2.3:a:cgm:clininet:*:*:*:*:*:*:*:*

History

09 Mar 2026, 15:11

Type	Values Removed	Values Added
CPE		cpe:2.3:a:cgm:clininet::::::::
First Time		Cgm clininet Cgm
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 4.3
References	~~() https://cert.pl/en/posts/2026/03/CVE-2025-10350/ -~~	() https://cert.pl/en/posts/2026/03/CVE-2025-10350/ - Third Party Advisory
References	~~() https://www.cgm.com/pol_pl/products/szpital/cgm-clininet.html -~~	() https://www.cgm.com/pol_pl/products/szpital/cgm-clininet.html - Product

02 Mar 2026, 12:16

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-03-02 12:16

Updated : 2026-03-09 15:11

NVD link : CVE-2025-58406

Mitre link : CVE-2025-58406

CVE.ORG link : CVE-2025-58406

JSON object : View

Products Affected

cgm

clininet

CWE

CWE-693

Protection Mechanism Failure

{"id": "CVE-2025-58406", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 2.8}], "cvssMetricV40": [{"type": "Secondary", "source": "cvd@cert.pl", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 5.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "published": "2026-03-02T12:16:01.923", "references": [{"url": "https://cert.pl/en/posts/2026/03/CVE-2025-10350/", "tags": ["Third Party Advisory"], "source": "cvd@cert.pl"}, {"url": "https://www.cgm.com/pol_pl/products/szpital/cgm-clininet.html", "tags": ["Product"], "source": "cvd@cert.pl"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "cvd@cert.pl", "description": [{"lang": "en", "value": "CWE-693"}]}], "descriptions": [{"lang": "en", "value": "The CGM CLININET application respond without essential security HTTP headers, exposing users to client\u2011side attacks such as clickjacking, MIME sniffing, unsafe caching, weak cross\u2011origin isolation, and missing transport security controls."}], "lastModified": "2026-03-09T15:11:00.580", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:cgm:clininet:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BBCA0F7E-EF98-41DF-A128-0D733443D02C", "versionEndExcluding": "2025.ms3"}], "operator": "OR"}]}], "sourceIdentifier": "cvd@cert.pl"}