Description

INFINITT ULite 5.0.2.1_BN48_20260528 and earlier protects image-share links with a low-entropy password and does not restrict repeated password attempts, allowing an unauthenticated remote attacker to brute-force the password within the link validity window and gain unauthorized access to shared medical images. Fixed in ULite 5.0.2.1 BN50.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-11-06T09:17:01.700Z",
  "pubdate": "2026-11-06T09:17:01.700Z",
  "executiveSummary": "INFINITT ULite versions 5.0.2.1_BN48_20260528 and earlier contain a critical authentication weakness concerning the protection of image-share links.\nThe vulnerability stems from the use of low-entropy passwords combined with the absence of rate-limiting or account lockout mechanisms for authentication attempts.\nThis flaw allows unauthenticated remote attackers to perform brute-force attacks against the shared links, potentially gaining unauthorized access to sensitive Protected Health Information (PHI) and medical imaging data.\nThe risk is significant due to the nature of the exposed data and the accessibility of the vulnerability over a network, enabling attackers to systematically harvest records without requiring prior authorization or specific user privileges.\nThis vulnerability is addressed in version ULite 5.0.2.1 BN50.",
  "technicalDetails": "The vulnerability resides within the image-sharing module of the INFINITT ULite system, specifically impacting the authentication mechanism governing access to external share links.\nRoot Cause Analysis: The security failure is twofold. First, the application generates passwords with insufficient entropy for image-share URLs, reducing the keyspace an attacker must traverse. Second, the system fails to implement mandatory security controls such as exponential backoff, request throttling, or account lockout policies after repeated failed authentication attempts.\nExploitation Flow: An unauthenticated remote attacker gains access to a targeted image-share link URL. Because the password protection mechanism does not track or block failed login attempts, the attacker can script automated HTTP requests to submit a high volume of guesses against the endpoint. Given the low-entropy nature of the passwords, the attacker can successfully brute-force the credential within the defined validity window of the shared link.\nAuthentication and Privileges: The vulnerability allows full authentication bypass. The attacker operates without any valid credentials and requires no special privileges within the INFINITT ULite environment to initiate or execute the attack.\nNetwork Exposure: The vulnerability is exploitable remotely, assuming the image-share URL is reachable over the network interface, which is a standard configuration for distributed medical imaging environments.\nPost-Exploitation Impact: Successful exploitation results in unauthorized access to medical records and imaging files shared via the link. This constitutes a breach of data confidentiality and potential non-compliance with healthcare data privacy regulations. The attacker could theoretically exfiltrate patient diagnostics, imaging history, and personal metadata associated with the compromised link.\nAffected Components: The primary vulnerable component is the password verification logic for shared links in INFINITT ULite versions 5.0.2.1_BN48_20260528 and earlier."
}