INFINITT Healthcare vulnerabilities and threats

INFINITT ULite versions up to 5.0.2.1_BN48_20260528 contain a vulnerability where image-share links are protected by low-entropy passwords without restrictions on repeated authentication attempts. This allows unauthenticated remote attackers to brute-force passwords within the link's validity period and gain unauthorized access to shared medical images. The issue is fixed in version 5.0.2.1_BN50.

CVE-2026-19876 is a reflected cross-site scripting (XSS) vulnerability in the login/SSO error page of INFINITT ULite versions up to 5.0.2.1_BN48_20260528. It allows unauthenticated remote attackers to execute arbitrary JavaScript in the browser of victims who open a crafted link. The vulnerability is due to an unsanitized request parameter that is reflected without proper output encoding. This flaw is fixed in version 5.0.2.1_BN50.

Local privilege escalation in `SmartUpdate.exe` and `SmartExecute.exe` in INFINITT Healthcare Co., Ltd. INFINITT PACS allows a local low-privileged attacker to execute arbitrary commands with administrator privileges via modification of a world-writable `execlist.txt` command manifest that is processed during application updates.

Remote Code Execution in the `IModular.exe` URI handler in INFINITT Healthcare Co., Ltd. INFINITT PACS allows a remote unauthenticated attacker to invoke unintended application functionality and potentially execute arbitrary code via a crafted `imodular:// URI` containing attacker-controlled command and argument parameters.

An attacker could exploit this vulnerability by uploading arbitrary files via a specific service, which could lead to system compromise.

An attacker could exploit this vulnerability by uploading arbitrary files via the a specific endpoint, leading to unauthorized remote code execution or system compromise.

Unauthorized users can access INFINITT PACS System Manager without proper authorization, which could lead to unauthorized access to system resources.