CGM MEDICO CVE-2025-48981
HIGHAttack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain foothold on hospital intranet
-
DeliveryPosition MITM on DNET traffic path
-
ExploitObserve unencrypted/optional-encryption DNET connection
-
ExecutionEavesdrop and tamper with transmitted data
-
ImpactExpose or alter patient records
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V14 - Data Protection Encryption of sensitive data
|
| Exploitation Conditions | Exploitation requires the attacker to already be present on the internal network ('within the intranet') and to establish a man-in-the-middle position on a CGM MEDICO DNET connection; the core precondition is that encryption is OPTIONAL for the DNET protocol, so the vulnerable path is any DNET session established without encryption negotiated. Limiting factors: the attacker must have intranet access and interception capability (not remotely exploitable from the public internet despite AV:N), and deployments that enforce the optional encryption for all DNET connections would not expose cleartext data; there is no authentication or user-interaction requirement to passively capture traffic. |
| Impact | This is a cleartext-transmission flaw (CWE-311) in the proprietary DNET protocol used by CGM MEDICO, where encryption is optional, enabling an on-network attacker to eavesdrop and tamper with data. The input CVSS vector (AV:N/AC:L/PR:N/UI:N, C:H/I:L/A:L, base 8.6) rates it High, but this CONFLICTS with the description, which explicitly scopes the attacker to 'within the intranet' - that is an adjacent/network-position (MITM) precondition, not true internet-wide reachability, so AV:N likely overstates reach (verify with vendor; adjacent AV:A is more defensible). Mitigating signals point to lower real-world urgency: EPSS is only 0.12% (2nd percentile), there is NO CISA KEV listing (not confirmed actively exploited), and no public exploit identified at time of analysis. Net assessment: a genuine confidentiality/integrity risk for anyone who can position on the hospital LAN, but the requirement to already be on the intranet and to perform active interception makes this a targeted/insider-adjacent concern rather than a mass-exploitable internet-facing emergency - treat as a prioritized patch for affected healthcare environments, not a drop-everything issue. |
| Exploit ScenarioDerived | An attacker who has gained a foothold on the hospital intranet (e.g., a malicious insider or compromised workstation) positions themselves between a CGM MEDICO client and server and passively captures DNET traffic that was negotiated without encryption, exposing sensitive clinical/patient data. The same position allows active manipulation of in-transit records. No public exploit code is identified at time of analysis, and exploitation requires a man-in-the-middle position on the internal network. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 08, 2026
Cleartext transmission in the proprietary DNET protocol used by CGM MEDICO allows an attacker who already has intranet access to passively eavesdrop on and manipulate clinical data, because encryption for DNET connections is optional and unprotected sessions are established without it. The issue is a missing-encryption flaw (CWE-311) affecting the protocol layer rather than a remotely exploitable service bug: no authentication or user interaction is required to capture traffic once the attacker is on the same network and can take a man-in-the-middle position. Exploitation is rated through an adjacent-network vector (AV:A) with high confidentiality impact, no public exploit code has been identified and the CVE is not in CISA KEV, and EPSS is very low (0.12%, 2nd percentile), indicating limited observed exploitation activity to date.
RemediationAI
Apply the vendor's guidance from the CGM security advisory at https://www.cgm.com/deu_de/allgemein/cybersecurity-en/security-advisoriy.html; no fixed software version is specified in the available data, so no patch level can be quoted here and the vendor must be consulted for the corrected build. The most direct mitigation is to configure CGM MEDICO so that encryption is mandatory for every DNET connection rather than optional, and to verify through capture that no cleartext DNET session is negotiated - the trade-off is that forcing encryption may break interoperability with older MEDICO components or third-party integrations that cannot negotiate a ciphered session. Where mandatory encryption cannot be enforced immediately, isolate MEDICO/DNET traffic on a dedicated VLAN with strict firewall and ACL rules limiting which hosts can reach the medical devices, tunnel DNET over an encrypted transport such as an IPsec or TLS-wrapped link between network segments, and enable 802.1X port authentication plus ARP/DHCP snooping and dynamic ARP inspection to make man-in-the-middle positioning significantly harder; each of these adds operational overhead and requires network changes that can disrupt clinical workflows if applied without testing. Finally, deploy network monitoring for duplicated ARP replies, unexpected MAC changes, or unusual DNET endpoints on the medical segment so interception attempts are detectable, and treat the absence of encryption checks as a standing audit item until the vendor confirms a fixed version.
Affected ProductsAI
CGM MEDICO deployments that use the proprietary DNET protocol with optional encryption enabled are affected; any DNET session negotiated without encryption is exposed. No CPE identifiers were supplied with this record, so affected-version granularity must be taken from the vendor. The authoritative source is the CGM cybersecurity advisory page: https://www.cgm.com/deu_de/allgemein/cybersecurity-en/security-advisoriy.html (also referenced from NVD). Organizations should confirm which MEDICO components speak DNET and verify their negotiated cipher settings, since the exposure depends on deployment configuration rather than a single identifiable build.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CWE-311 (Missing Encryption of Sensitive Data) applies to DNET, a proprietary protocol used by CGM MEDICO for communication within the product's ecosystem. Because the protocol specification makes encryption optional, a DNET session can be negotiated in cleartext, exposing both payload confidentiality and integrity to anyone who can observe or interpose on the traffic path. The vulnerable condition is the absence of mandatory transport encryption rather than a memory-safety or injection defect, so the attack is a classic on-path/man-in-the-middle interception: an attacker on the same intranet segment reads or modifies DNET messages in transit. The authenticated-privilege requirement for delivering the attack does not apply - the CVSS vector (PR:N) confirms no prior authentication is needed to consume captured traffic, but the attacker must still acquire intranet presence and interception capability, which is why the independent assessment places the vector at AV:A rather than the network-level AV:N in the published score.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
Requires an intranet MITM position so AV:A not AV:N; no auth since encryption is optional (PR:N); eavesdropping gives C:H and data manipulation gives I:H, with no availability impact (A:N).
Primary rating from Vendor (hackerone).
CVSS VectorVendor: hackerone
DescriptionCVE.org
An insecure implementation of the proprietary protocol DNET in Product CGM MEDICO allows attackers within the intranet to eavesdrop and manipulate data on the protocol because encryption is optional for this connection.
Executive ViewAI
CGM MEDICO's DNET protocol transmits clinical data in cleartext, allowing attackers with intranet access to eavesdrop on or manipulate sensitive patient information. This missing-encryption flaw affects the confidentiality and integrity of clinical data, potentially leading to data breaches, regulatory penalties, and patient safety risks. Although no public exploit identified at time of analysis, leadership should prioritize mitigation because the vulnerability requires only adjacent network access and no vendor-released patch identified at time of analysis.
No vendor patch available. Enforce DNET encryption if configurable; if not, implement network segmentation, restrict intranet access to CGM MEDICO devices, monitor for anomalous traffic, and use encrypted tunnels (e.g., IPsec) for DNET communications.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
GitHub PoC
Exploit-DB