{"document":{"acknowledgments":[{"urls":["https://kb.cert.org/vuls/id/203719#acknowledgements"]}],"category":"CERT/CC Vulnerability Note","csaf_version":"2.0","notes":[{"category":"summary","text":"### Overview\r\nINFINITT PACS installations using System Manager versions 3.0.11.3 and 3.0.11.5 contain vulnerabilities that may allow an attacker to execute arbitrary code. INFINITT Healthcare has remediated the issues in System Manager versions 3.0.12.3 and 3.0.12.5.\r\n\r\n### Description\r\nINFINITT PACS is an enterprise web-based medical imaging platform that stores, retrieves, and displays patient scans. \r\n\r\n**CVE-2026-16305**  \r\nAn improperly protected update manifest may allow a local attacker to execute commands with administrative privileges when an update is approved.  \r\n`SmartExecute.exe` reads and runs commands from `execlist.txt` after an update. Because of insecure file permissions on `execlist.txt`, a low-privileged attacker can modify the file before it is processed to add arbitrary malicious commands. After `SmartUpdate.exe` launches, it runs `SmartExecute.exe` and the user can be prompted by User Account Control (UAC), which can allow the malicious command to execute with administrative privileges.\r\n\r\n**CVE-2026-16306**   \r\nAn unsafe command dispatch through the registered `imodular://` URI scheme may result in code execution.  \r\nA vulnerability in `IModular.exe` allows an attacker to execute certain application functions by supplying a crafted `imodular://` link. The application reads the `cmd` value from the link and executes the corresponding function without verifying that the command is permitted or safe. By convincing an end user to open a crafted `imodular://` link, an attacker can cause `IModular.exe` to access attacker-controlled files or run specific programs from a local folder or network share. The link also accepts a `url` parameter that causes `IModular.exe` to connect to an attacker-controlled SignalR endpoint, creating an unauthorized outbound connection.\r\n\r\n### Impact\r\nSuccessful exploitation of CVE-2026-16305 may allow a local, low-privileged attacker to execute arbitrary commands with administrative privileges on the affected workstation. An attacker could then install or modify software, access protected files, disable security controls, or establish persistent access to the system.\r\nSuccessful exploitation of CVE-2026-16306 may allow a remote attacker to execute code with the privileges of the affected user, access or modify data available to that user, and use the compromised workstation as a foothold for further attacks. The vulnerability may allow unauthorized outbound communication with an attacker-controlled SignalR server, potentially exposing sensitive information or enabling additional malicious activity.\r\n\r\n### Solution\r\nThere are no indications that these vulnerabilities have been exploited. INFINITT Healthcare recommends upgrading affected installations to one of the following fixed System Manager versions:\r\n\r\n* System Manager 3.0.12.3\r\n* System Manager 3.0.12.5\r\n\r\nOrganizations should apply the appropriate update as soon as operationally feasible.\r\n\r\n### Acknowledgements\r\nThanks to Piotr Berlinski from CyberArms.io for identifying these vulnerabilities, and to INFINITT for quickly addressing the problems. This document was written by Michael Bragg.","title":"Summary"},{"category":"legal_disclaimer","text":"THIS DOCUMENT IS PROVIDED ON AN 'AS IS' BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS AT YOUR OWN RISK. ","title":"Legal Disclaimer"},{"category":"other","text":"CERT/CC Vulnerability Note is a limited advisory. It primarily identifies vendors impacted by the advisory and not specific products. We only support \"known_affected\" and \"known_not_affected\" status. Please consult the vendor's statements and advisory URL if provided by the vendor for more details ","title":"Limitations of Advisory"}],"publisher":{"category":"coordinator","contact_details":"Email: cert@cert.org, Phone: +1412 268 5800","issuing_authority":"CERT/CC under DHS/CISA https://www.cisa.gov/cybersecurity also see https://kb.cert.org/ ","name":"CERT/CC","namespace":"https://kb.cert.org/"},"references":[{"url":"https://certcc.github.io/certcc_disclosure_policy","summary":"CERT/CC vulnerability disclosure policy"},{"summary":"CERT/CC document released","category":"self","url":"https://kb.cert.org/vuls/id/203719"},{"url":"https://www.infinittna.com/","summary":"https://www.infinittna.com/"}],"title":"INFINITT PACS System Manager Contains Multiple Code Execution Vulnerabilities","tracking":{"current_release_date":"2026-11-02T15:38:19+00:00","generator":{"engine":{"name":"VINCE","version":"3.0.52"}},"id":"VU#203719","initial_release_date":"2026-11-02 15:38:19.227086+00:00","revision_history":[{"date":"2026-11-02T15:38:19+00:00","number":"1.20261102153819.1","summary":"Released on 2026-11-02T15:38:19+00:00"}],"status":"final","version":"1.20261102153819.1"}},"vulnerabilities":[{"title":"Local privilege escalation in `SmartUpdate.","notes":[{"category":"summary","text":"Local privilege escalation in `SmartUpdate.exe` and `SmartExecute.exe` in INFINITT Healthcare Co., Ltd. INFINITT PACS allows a local low-privileged attacker to execute arbitrary commands with administrator privileges via modification of a world-writable `execlist.txt` command manifest that is processed during application updates."}],"cve":"CVE-2026-16305","ids":[{"system_name":"CERT/CC V Identifier ","text":"VU#203719"}]},{"title":"Remote Code Execution in the `IModular.","notes":[{"category":"summary","text":"Remote Code Execution in the `IModular.exe` URI handler in INFINITT Healthcare Co., Ltd. INFINITT PACS allows a remote unauthenticated attacker to invoke unintended application functionality and potentially execute arbitrary code via a crafted `imodular:// URI` containing attacker-controlled command and argument parameters."}],"cve":"CVE-2026-16306","ids":[{"system_name":"CERT/CC V Identifier ","text":"VU#203719"}]}],"product_tree":{"branches":[]}}