CVE-2025-24489 is a vulnerability classified under CWE-434 (Unrestricted Upload of File with Dangerous Type) affecting the INFINITT Healthcare INFINITT PACS System Manager. This vulnerability allows an attacker with limited privileges (PR:L) to upload arbitrary files through a specific service interface without requiring user interaction (UI:N). The vulnerability is remotely exploitable over the network (AV:N) with low attack complexity (AC:L). Successful exploitation could lead to partial compromise of confidentiality, integrity, and availability of the affected system. Specifically, an attacker could upload malicious files, potentially leading to execution of arbitrary code, unauthorized access to sensitive medical imaging data, or disruption of PACS services. The vulnerability affects all versions indicated as '0' (likely meaning initial or unspecified versions) and was published on August 21, 2025. The CVSS v3.1 base score is 6.3, indicating a medium severity level. No known exploits are currently reported in the wild, and no patches have been linked yet. The vulnerability's impact is significant given the critical role of PACS (Picture Archiving and Communication System) in healthcare environments, where maintaining the confidentiality and integrity of medical images and patient data is paramount. The lack of user interaction requirement and network accessibility increase the risk profile, especially in environments where the system is exposed or insufficiently segmented.

For European healthcare organizations, this vulnerability poses a substantial risk. PACS systems are integral to diagnostic workflows, storing and transmitting sensitive patient imaging data. Exploitation could lead to unauthorized disclosure of protected health information (PHI), violating GDPR and other data protection regulations, resulting in legal and financial penalties. Integrity compromise could lead to altered or corrupted medical images, potentially causing misdiagnosis or treatment errors. Availability impact could disrupt clinical operations, delaying patient care. Given the interconnected nature of healthcare IT infrastructures in Europe, a successful attack could propagate or be leveraged for further lateral movement. Additionally, healthcare providers are high-value targets for ransomware and espionage, increasing the attractiveness of this vulnerability to threat actors. The medium CVSS score suggests a moderate but non-negligible risk, especially if combined with other vulnerabilities or misconfigurations.

European healthcare organizations using INFINITT PACS System Manager should implement the following specific mitigations: 1) Immediately restrict network access to the PACS System Manager service to trusted internal networks and authorized personnel only, using network segmentation and firewall rules. 2) Enforce strict access controls and monitor accounts with privileges capable of uploading files to the system, employing multi-factor authentication where possible. 3) Implement file upload validation and filtering at the network or application layer to detect and block suspicious file types or payloads. 4) Conduct regular integrity checks and monitoring of uploaded files and system binaries to detect unauthorized changes. 5) Maintain comprehensive logging and alerting for file upload activities to enable rapid detection and response. 6) Engage with INFINITT Healthcare for timely patch releases and apply updates as soon as they become available. 7) Perform security assessments and penetration testing focused on file upload functionalities to identify additional weaknesses. 8) Educate IT and security staff about the risks associated with this vulnerability and the importance of rapid incident response.