INFINITT PACS System Manager Contains Multiple Code Execution Vulnerabilities
Original title: VU#203719: INFINITT PACS System Manager Contains Multiple Code Execution Vulnerabilities
INFINITT PACS System Manager versions 3.0.11.3 and 3.0.11.5 contain multiple code execution vulnerabilities that may allow local and remote attackers to execute arbitrary code.
INFINITT PACS installations using System Manager versions 3.0.11.3 and 3.0.11.5 contain vulnerabilities that may allow an attacker to execute arbitrary code. INFINITT Healthcare has remediated the issues in System Manager versions 3.0.12.3 and 3.0.12.5. CVE-2026-16305: An improperly protected update manifest may allow a local attacker to execute commands with administrative privileges when an update is approved. CVE-2026-16306: An unsafe command dispatch through the registered imodular:// URI scheme may result in code execution. There are no indications that these vulnerabilities have been exploited.
- Fixed in System Manager 3.0.12.3 and 3.0.12.5.
- Successful exploitation of CVE-2026-16305 may allow local low-privileged attacker to execute arbitrary commands with administrative privileges.
- Successful exploitation of CVE-2026-16306 may allow remote attacker to execute code with the privileges of the affected user.
- Vulnerabilities identified by Piotr Berlinski from CyberArms.io.
Impact: Arbitrary code execution with administrative privileges
| Product | Affected | Fixed in |
|---|---|---|
| INFINITT PACS System Manager | 3.0.11.3 and 3.0.11.5 | 3.0.12.3 and 3.0.12.5 |
- 1.Upgrade to System Manager 3.0.12.3 or 3.0.12.5
- Vendors
- INFINITT
- Products
- PACS System Manager
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-16306+1 related CVE | RCE via imodular:// URI handler in INFINITT PACS | 9.8 group max | — |
From the original article
2 min read at kb.cert.orgOverview INFINITT PACS installations using System Manager versions 3. 0. 11.
kb.cert.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.