Read the docs
TI-2026-85787 Aliases CVE-2026-19877GHSA-mw63-5fwq-j4r5

Brute-forceable share link password in INFINITT ULite exposes images

Priority LOW 33CWE-307Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-307.

Summary

INFINITT ULite 5.0.2.1_BN48_20260528 and earlier protects image-share links with a low-entropy password (CWE-331) and does not restrict repeated password attempts. An unauthenticated remote attacker can brute-force the password within the link validity window and gain access to shared medical images.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

INFINITT ULite 5.0.2.1_BN48_20260528 and earlier protects image-share links with a low-entropy password and does not restrict repeated password attempts, allowing an unauthenticated remote attacker to brute-force the password within the link validity window and gain unauthorized access to shared medical images. Fixed in ULite 5.0.2.1 BN50.

Why it matters now

EPSS 0.00292 21st percentileScored 2026-11-07
Fix Fixed INFINITT ULite (INFINITT Healthcare): 5.0.2.1_BN50

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
INFINITT HealthcareINFINITT ULiteup to 5.0.2.1_BN48_202605285.0.2.1_BN50Patch availableCNA
  • INFINITT ULite VendorINFINITT Healthcare Affected up to 5.0.2.1_BN48_20260528 Fixed in 5.0.2.1_BN50 Patch available CNA

Remediation

Upgrade INFINITT ULite to 5.0.2.1_BN50, the fixed version.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

  • Fix · CNA INFINITT ULite (INFINITT Healthcare) Fixed in 5.0.2.1_BN50

Timeline

  1. 2026-11-06 Threatist record created from CVE-2026-19877
  2. 2026-11-06 Alias added: GHSA-mw63-5fwq-j4r5
  3. 2026-11-07 Priority changed: MEDIUM → LOW

References

Other 1

  • TI-2026-83877 Remote code execution in INFINITT PACS via imodular:// URI handler CVSS 3.1CRITICAL 9.8
  • TI-2025-20515 INFINITT Healthcare INFINITT PACS Exposure of Sensitive System Information to an Unauthorized Control Sphere CVSS 4.0HIGH 8.7
  • TI-2026-84027 Local privilege escalation in INFINITT System Manager CVSS 3.1HIGH 7.8
  • TI-2026-85785 Reflected XSS in INFINITT ULite login error page CVSS 3.1MEDIUM 6.1
  • TI-2025-20508 INFINITT Healthcare INFINITT PACS Unrestricted Upload of File with Dangerous Type CVSS 4.0MEDIUM 5.3
  • TI-2025-18211 INFINITT Healthcare INFINITT PACS Unrestricted Upload of File with Dangerous Type CVSS 4.0MEDIUM 5.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences