CVE-2025-48981

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-48981", "assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1", "state": "PUBLISHED", "assignerShortName": "hackerone", "dateReserved": "2025-05-29T15:00:04.773Z", "datePublished": "2025-10-08T00:49:16.646Z", "dateUpdated": "2025-10-09T01:06:32.695Z"}, "containers": {"cna": {"descriptions": [{"lang": "en", "value": "An insecure implementation of the proprietary protocol DNET in Product CGM MEDICO allows attackers within the intranet to eavesdrop and manipulate data on the protocol because encryption is optional for this connection."}], "affected": [{"defaultStatus": "unaffected", "vendor": "CompuGroup Medical", "product": "CGM MEDICO", "versions": [{"version": "29.0", "status": "affected", "lessThan": "29.1", "versionType": "semver"}]}], "references": [{"url": "https://www.cgm.com/deu_de/allgemein/cybersecurity-en/security-advisoriy.html"}], "providerMetadata": {"orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1", "shortName": "hackerone", "dateUpdated": "2025-10-09T01:06:32.695Z"}}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-311", "lang": "en", "description": "CWE-311 Missing Encryption of Sensitive Data"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.6, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2025-10-08T13:18:24.008524Z", "id": "CVE-2025-48981", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-08T13:20:43.202Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.6, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2025-48981", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-10-08T13:18:24.008524Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-311", "description": "CWE-311 Missing Encryption of Sensitive Data"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-08T13:19:10.791Z"}}], "cna": {"affected": [{"vendor": "CompuGroup Medical", "product": "CGM MEDICO", "versions": [{"status": "affected", "version": "29.0", "lessThan": "29.1", "versionType": "semver"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://www.cgm.com/deu_de/allgemein/cybersecurity-en/security-advisoriy.html"}], "descriptions": [{"lang": "en", "value": "An insecure implementation of the proprietary protocol DNET in Product CGM MEDICO allows attackers within the intranet to eavesdrop and manipulate data on the protocol because encryption is optional for this connection."}], "providerMetadata": {"orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1", "shortName": "hackerone", "dateUpdated": "2025-10-09T01:06:32.695Z"}}}, "cveMetadata": {"cveId": "CVE-2025-48981", "state": "PUBLISHED", "dateUpdated": "2025-10-09T01:06:32.695Z", "dateReserved": "2025-05-29T15:00:04.773Z", "assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1", "datePublished": "2025-10-08T00:49:16.646Z", "assignerShortName": "hackerone"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "CGM MEDICO", "vendor": "CompuGroup Medical", "versions": [{"lessThan": "29.1", "status": "affected", "version": "29.0", "versionType": "semver"}]}], "source": "support@hackerone.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "An insecure implementation of the proprietary protocol DNET in Product CGM MEDICO allows attackers within the intranet to eavesdrop and manipulate data on the protocol because encryption is optional for this connection."}, {"lang": "es", "value": "Una implementaci\u00f3n insegura del protocolo propietario DNET en el Producto CGM MEDICO permite a los atacantes dentro de la intranet interceptar y manipular datos en el protocolo porque el cifrado es opcional para esta conexi\u00f3n."}], "id": "CVE-2025-48981", "lastModified": "2026-10-08T13:10:00.200", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 8.6, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 4.7, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-48981", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-10-08T13:18:24.008524Z", "version": "2.0.3"}}]}, "published": "2025-10-08T01:15:32.717", "references": [{"source": "support@hackerone.com", "url": "https://www.cgm.com/deu_de/allgemein/cybersecurity-en/security-advisoriy.html"}], "sourceIdentifier": "support@hackerone.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-311"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{}

{"created": "2025-10-08T13:35:05.019524+00:00", "updated": "2025-10-08T13:35:05.019550+00:00", "vendors": ["compugroup_medical", "compugroup_medical$PRODUCT$cgm_medico"]}