Search
Find a vulnerability
Search criteria
ⓘ
Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.
6 vulnerabilities by INFINITT Healthcare
CVE-2025-24489 (GCVE-0-2025-24489)
Vulnerability from cvelistv5 – Published: 2025-08-21 19:44 – Updated: 2025-08-21 20:09
VLAI
Title
INFINITT Healthcare INFINITT PACS Unrestricted Upload of File with Dangerous Type
Summary
An attacker could exploit this vulnerability by uploading arbitrary
files via a specific service, which could lead to system compromise.
Severity
6.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| INFINITT Healthcare | INFINITT PACS System Manager |
Affected:
0 , ≤ 3.0.11.5 BN9
(custom)
Unaffected: 3.0.11.5 BN10 |
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-24489",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-08-21T20:09:30.758583Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-08-21T20:09:44.406Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "INFINITT PACS System Manager",
"vendor": "INFINITT Healthcare",
"versions": [
{
"lessThanOrEqual": "3.0.11.5 BN9",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "3.0.11.5 BN10"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Piotr Kijewski of the Shadowserver Foundation reported these vulnerabilities to CISA."
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "An attacker could exploit this vulnerability by uploading arbitrary \nfiles via a specific service, which could lead to system compromise."
}
],
"value": "An attacker could exploit this vulnerability by uploading arbitrary \nfiles via a specific service, which could lead to system compromise."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-434",
"description": "CWE-434",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-08-21T19:44:18.551Z",
"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"shortName": "icscert"
},
"references": [
{
"url": "https://www.cisa.gov/news-events/ics-medical-advisories/icsma-25-100-01"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eINFINITT recommends the following mitigations:\u003c/p\u003e\n\u003cp\u003eThe latest version of the software (3.0.11.5 BN10 or later) is NOT affected, as it includes default security patches.\u003c/p\u003e\n\u003cp\u003eINFINITT ULite is NOT affected by these vulnerabilities. However, if \nINFINITT ULite is operating as an integrated system with INFINITT PACS, \npatching is required to secure the PACS environment.\u003c/p\u003e\n\u003cul\u003e\u003cli\u003eApply the security patch and configure the System Manager settings to restrict unauthorized file uploads.\u003c/li\u003e\n\u003cli\u003eNetwork Security Recommendations: Minimize network exposure for PACS\n servers, ensuring they are not directly accessible from the internet.\u003c/li\u003e\u003cli\u003eContact Information: Customers requiring additional support should contact INFINITT Security Team. (\u003ca target=\"_blank\" rel=\"nofollow\"\u003ecybersecurity@infinitt.com\u003c/a\u003e)\n\n\u003cbr\u003e\u003c/li\u003e\u003c/ul\u003e"
}
],
"value": "INFINITT recommends the following mitigations:\n\n\nThe latest version of the software (3.0.11.5 BN10 or later) is NOT affected, as it includes default security patches.\n\n\nINFINITT ULite is NOT affected by these vulnerabilities. However, if \nINFINITT ULite is operating as an integrated system with INFINITT PACS, \npatching is required to secure the PACS environment.\n\n\n * Apply the security patch and configure the System Manager settings to restrict unauthorized file uploads.\n\n * Network Security Recommendations: Minimize network exposure for PACS\n servers, ensuring they are not directly accessible from the internet.\n * Contact Information: Customers requiring additional support should contact INFINITT Security Team. (cybersecurity@infinitt.com)"
}
],
"source": {
"advisory": "ICSMA-25-100-01",
"discovery": "EXTERNAL"
},
"title": "INFINITT Healthcare INFINITT PACS Unrestricted Upload of File with Dangerous Type",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"assignerShortName": "icscert",
"cveId": "CVE-2025-24489",
"datePublished": "2025-08-21T19:44:18.551Z",
"dateReserved": "2025-03-19T16:39:28.811Z",
"dateUpdated": "2025-08-21T20:09:44.406Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-27714 (GCVE-0-2025-27714)
Vulnerability from cvelistv5 – Published: 2025-08-21 19:42 – Updated: 2025-08-21 20:08
VLAI
Title
INFINITT Healthcare INFINITT PACS Unrestricted Upload of File with Dangerous Type
Summary
An attacker could exploit this vulnerability by uploading arbitrary
files via the a specific endpoint, leading to unauthorized remote code
execution or system compromise.
Severity
6.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| INFINITT Healthcare | INFINITT PACS System Manager |
Affected:
0 , ≤ 3.0.11.5 BN9
(custom)
Unaffected: 3.0.11.5 BN10 |
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-27714",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-08-21T20:08:49.089078Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-08-21T20:08:59.493Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "INFINITT PACS System Manager",
"vendor": "INFINITT Healthcare",
"versions": [
{
"lessThanOrEqual": "3.0.11.5 BN9",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "3.0.11.5 BN10"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Piotr Kijewski of the Shadowserver Foundation reported these vulnerabilities to CISA."
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "An attacker could exploit this vulnerability by uploading arbitrary \nfiles via the a specific endpoint, leading to unauthorized remote code \nexecution or system compromise."
}
],
"value": "An attacker could exploit this vulnerability by uploading arbitrary \nfiles via the a specific endpoint, leading to unauthorized remote code \nexecution or system compromise."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-434",
"description": "CWE-434",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-08-21T19:42:59.699Z",
"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"shortName": "icscert"
},
"references": [
{
"url": "https://www.cisa.gov/news-events/ics-medical-advisories/icsma-25-100-01"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eINFINITT recommends the following mitigations:\u003c/p\u003e\n\u003cp\u003eThe latest version of the software (3.0.11.5 BN10 or later) is NOT affected, as it includes default security patches.\u003c/p\u003e\n\u003cp\u003eINFINITT ULite is NOT affected by these vulnerabilities. However, if \nINFINITT ULite is operating as an integrated system with INFINITT PACS, \npatching is required to secure the PACS environment.\u003c/p\u003e\n\u003cul\u003e\u003cli\u003eApply the security patch and configure the System Manager settings to restrict unauthorized file uploads.\u003c/li\u003e\n\u003cli\u003eNetwork Security Recommendations: Minimize network exposure for PACS\n servers, ensuring they are not directly accessible from the internet.\u003c/li\u003e\u003cli\u003eContact Information: Customers requiring additional support should contact INFINITT Security Team. (\u003ca target=\"_blank\" rel=\"nofollow\"\u003ecybersecurity@infinitt.com\u003c/a\u003e)\n\n\u003cbr\u003e\u003c/li\u003e\u003c/ul\u003e"
}
],
"value": "INFINITT recommends the following mitigations:\n\n\nThe latest version of the software (3.0.11.5 BN10 or later) is NOT affected, as it includes default security patches.\n\n\nINFINITT ULite is NOT affected by these vulnerabilities. However, if \nINFINITT ULite is operating as an integrated system with INFINITT PACS, \npatching is required to secure the PACS environment.\n\n\n * Apply the security patch and configure the System Manager settings to restrict unauthorized file uploads.\n\n * Network Security Recommendations: Minimize network exposure for PACS\n servers, ensuring they are not directly accessible from the internet.\n * Contact Information: Customers requiring additional support should contact INFINITT Security Team. (cybersecurity@infinitt.com)"
}
],
"source": {
"advisory": "ICSMA-25-100-01",
"discovery": "EXTERNAL"
},
"title": "INFINITT Healthcare INFINITT PACS Unrestricted Upload of File with Dangerous Type",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"assignerShortName": "icscert",
"cveId": "CVE-2025-27714",
"datePublished": "2025-08-21T19:42:59.699Z",
"dateReserved": "2025-03-19T16:39:28.817Z",
"dateUpdated": "2025-08-21T20:08:59.493Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-27721 (GCVE-0-2025-27721)
Vulnerability from cvelistv5 – Published: 2025-08-21 19:33 – Updated: 2025-08-22 15:50
VLAI
Title
INFINITT Healthcare INFINITT PACS Exposure of Sensitive System Information to an Unauthorized Control Sphere
Summary
Unauthorized users can access INFINITT PACS System Manager without proper authorization,
which could lead to unauthorized access to system resources.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| INFINITT Healthcare | INFINITT PACS System Manager |
Affected:
0 , ≤ 3.0.11.5 BN9
(custom)
Unaffected: 3.0.11.5 BN10 |
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-27721",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-08-22T15:50:46.203499Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-08-22T15:50:50.711Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "INFINITT PACS System Manager",
"vendor": "INFINITT Healthcare",
"versions": [
{
"lessThanOrEqual": "3.0.11.5 BN9",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "3.0.11.5 BN10"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Piotr Kijewski of the Shadowserver Foundation reported these vulnerabilities to CISA."
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Unauthorized users can access INFINITT PACS System Manager\u0026nbsp;without proper authorization, \nwhich could lead to unauthorized access to system resources."
}
],
"value": "Unauthorized users can access INFINITT PACS System Manager\u00a0without proper authorization, \nwhich could lead to unauthorized access to system resources."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-497",
"description": "CWE-497",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-08-21T19:33:03.503Z",
"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"shortName": "icscert"
},
"references": [
{
"url": "https://www.cisa.gov/news-events/ics-medical-advisories/icsma-25-100-01"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eINFINITT recommends the following mitigations:\u003c/p\u003e\n\u003cp\u003eThe latest version of the software (3.0.11.5 BN10 or later) is NOT affected, as it includes default security patches.\u003c/p\u003e\n\u003cp\u003eINFINITT ULite is NOT affected by these vulnerabilities. However, if \nINFINITT ULite is operating as an integrated system with INFINITT PACS, \npatching is required to secure the PACS environment.\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eFor CVE-2025-27714 and CVE-2025-24489: Apply the security patch and \nconfigure the System Manager settings to restrict unauthorized file \nuploads.\u003c/li\u003e\n\u003cli\u003eFor CVE-2025-27721: Apply the patch, enforce strong password \npolicies, and enable logging to monitor for unauthorized access \nattempts.\u003c/li\u003e\n\u003cli\u003eNetwork Security Recommendations: Minimize network exposure for PACS\n servers, ensuring they are not directly accessible from the internet.\u003c/li\u003e\u003cli\u003eContact Information: Customers requiring additional support should contact INFINITT Security Team. (\u003ca target=\"_blank\" rel=\"nofollow\"\u003ecybersecurity@infinitt.com\u003c/a\u003e)\n\n\u003cbr\u003e\u003c/li\u003e\u003c/ul\u003e"
}
],
"value": "INFINITT recommends the following mitigations:\n\n\nThe latest version of the software (3.0.11.5 BN10 or later) is NOT affected, as it includes default security patches.\n\n\nINFINITT ULite is NOT affected by these vulnerabilities. However, if \nINFINITT ULite is operating as an integrated system with INFINITT PACS, \npatching is required to secure the PACS environment.\n\n\n\n * For CVE-2025-27714 and CVE-2025-24489: Apply the security patch and \nconfigure the System Manager settings to restrict unauthorized file \nuploads.\n\n * For CVE-2025-27721: Apply the patch, enforce strong password \npolicies, and enable logging to monitor for unauthorized access \nattempts.\n\n * Network Security Recommendations: Minimize network exposure for PACS\n servers, ensuring they are not directly accessible from the internet.\n * Contact Information: Customers requiring additional support should contact INFINITT Security Team. (cybersecurity@infinitt.com)"
}
],
"source": {
"advisory": "ICSMA-25-100-01",
"discovery": "EXTERNAL"
},
"title": "INFINITT Healthcare INFINITT PACS Exposure of Sensitive System Information to an Unauthorized Control Sphere",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"assignerShortName": "icscert",
"cveId": "CVE-2025-27721",
"datePublished": "2025-08-21T19:33:03.503Z",
"dateReserved": "2025-03-19T16:39:28.803Z",
"dateUpdated": "2025-08-22T15:50:50.711Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-24489 (GCVE-0-2025-24489)
Vulnerability from nvd – Published: 2025-08-21 19:44 – Updated: 2025-08-21 20:09
VLAI
Title
INFINITT Healthcare INFINITT PACS Unrestricted Upload of File with Dangerous Type
Summary
An attacker could exploit this vulnerability by uploading arbitrary
files via a specific service, which could lead to system compromise.
Severity
6.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| INFINITT Healthcare | INFINITT PACS System Manager |
Affected:
0 , ≤ 3.0.11.5 BN9
(custom)
Unaffected: 3.0.11.5 BN10 |
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-24489",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-08-21T20:09:30.758583Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-08-21T20:09:44.406Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "INFINITT PACS System Manager",
"vendor": "INFINITT Healthcare",
"versions": [
{
"lessThanOrEqual": "3.0.11.5 BN9",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "3.0.11.5 BN10"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Piotr Kijewski of the Shadowserver Foundation reported these vulnerabilities to CISA."
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "An attacker could exploit this vulnerability by uploading arbitrary \nfiles via a specific service, which could lead to system compromise."
}
],
"value": "An attacker could exploit this vulnerability by uploading arbitrary \nfiles via a specific service, which could lead to system compromise."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-434",
"description": "CWE-434",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-08-21T19:44:18.551Z",
"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"shortName": "icscert"
},
"references": [
{
"url": "https://www.cisa.gov/news-events/ics-medical-advisories/icsma-25-100-01"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eINFINITT recommends the following mitigations:\u003c/p\u003e\n\u003cp\u003eThe latest version of the software (3.0.11.5 BN10 or later) is NOT affected, as it includes default security patches.\u003c/p\u003e\n\u003cp\u003eINFINITT ULite is NOT affected by these vulnerabilities. However, if \nINFINITT ULite is operating as an integrated system with INFINITT PACS, \npatching is required to secure the PACS environment.\u003c/p\u003e\n\u003cul\u003e\u003cli\u003eApply the security patch and configure the System Manager settings to restrict unauthorized file uploads.\u003c/li\u003e\n\u003cli\u003eNetwork Security Recommendations: Minimize network exposure for PACS\n servers, ensuring they are not directly accessible from the internet.\u003c/li\u003e\u003cli\u003eContact Information: Customers requiring additional support should contact INFINITT Security Team. (\u003ca target=\"_blank\" rel=\"nofollow\"\u003ecybersecurity@infinitt.com\u003c/a\u003e)\n\n\u003cbr\u003e\u003c/li\u003e\u003c/ul\u003e"
}
],
"value": "INFINITT recommends the following mitigations:\n\n\nThe latest version of the software (3.0.11.5 BN10 or later) is NOT affected, as it includes default security patches.\n\n\nINFINITT ULite is NOT affected by these vulnerabilities. However, if \nINFINITT ULite is operating as an integrated system with INFINITT PACS, \npatching is required to secure the PACS environment.\n\n\n * Apply the security patch and configure the System Manager settings to restrict unauthorized file uploads.\n\n * Network Security Recommendations: Minimize network exposure for PACS\n servers, ensuring they are not directly accessible from the internet.\n * Contact Information: Customers requiring additional support should contact INFINITT Security Team. (cybersecurity@infinitt.com)"
}
],
"source": {
"advisory": "ICSMA-25-100-01",
"discovery": "EXTERNAL"
},
"title": "INFINITT Healthcare INFINITT PACS Unrestricted Upload of File with Dangerous Type",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"assignerShortName": "icscert",
"cveId": "CVE-2025-24489",
"datePublished": "2025-08-21T19:44:18.551Z",
"dateReserved": "2025-03-19T16:39:28.811Z",
"dateUpdated": "2025-08-21T20:09:44.406Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-27714 (GCVE-0-2025-27714)
Vulnerability from nvd – Published: 2025-08-21 19:42 – Updated: 2025-08-21 20:08
VLAI
Title
INFINITT Healthcare INFINITT PACS Unrestricted Upload of File with Dangerous Type
Summary
An attacker could exploit this vulnerability by uploading arbitrary
files via the a specific endpoint, leading to unauthorized remote code
execution or system compromise.
Severity
6.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| INFINITT Healthcare | INFINITT PACS System Manager |
Affected:
0 , ≤ 3.0.11.5 BN9
(custom)
Unaffected: 3.0.11.5 BN10 |
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-27714",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-08-21T20:08:49.089078Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-08-21T20:08:59.493Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "INFINITT PACS System Manager",
"vendor": "INFINITT Healthcare",
"versions": [
{
"lessThanOrEqual": "3.0.11.5 BN9",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "3.0.11.5 BN10"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Piotr Kijewski of the Shadowserver Foundation reported these vulnerabilities to CISA."
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "An attacker could exploit this vulnerability by uploading arbitrary \nfiles via the a specific endpoint, leading to unauthorized remote code \nexecution or system compromise."
}
],
"value": "An attacker could exploit this vulnerability by uploading arbitrary \nfiles via the a specific endpoint, leading to unauthorized remote code \nexecution or system compromise."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-434",
"description": "CWE-434",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-08-21T19:42:59.699Z",
"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"shortName": "icscert"
},
"references": [
{
"url": "https://www.cisa.gov/news-events/ics-medical-advisories/icsma-25-100-01"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eINFINITT recommends the following mitigations:\u003c/p\u003e\n\u003cp\u003eThe latest version of the software (3.0.11.5 BN10 or later) is NOT affected, as it includes default security patches.\u003c/p\u003e\n\u003cp\u003eINFINITT ULite is NOT affected by these vulnerabilities. However, if \nINFINITT ULite is operating as an integrated system with INFINITT PACS, \npatching is required to secure the PACS environment.\u003c/p\u003e\n\u003cul\u003e\u003cli\u003eApply the security patch and configure the System Manager settings to restrict unauthorized file uploads.\u003c/li\u003e\n\u003cli\u003eNetwork Security Recommendations: Minimize network exposure for PACS\n servers, ensuring they are not directly accessible from the internet.\u003c/li\u003e\u003cli\u003eContact Information: Customers requiring additional support should contact INFINITT Security Team. (\u003ca target=\"_blank\" rel=\"nofollow\"\u003ecybersecurity@infinitt.com\u003c/a\u003e)\n\n\u003cbr\u003e\u003c/li\u003e\u003c/ul\u003e"
}
],
"value": "INFINITT recommends the following mitigations:\n\n\nThe latest version of the software (3.0.11.5 BN10 or later) is NOT affected, as it includes default security patches.\n\n\nINFINITT ULite is NOT affected by these vulnerabilities. However, if \nINFINITT ULite is operating as an integrated system with INFINITT PACS, \npatching is required to secure the PACS environment.\n\n\n * Apply the security patch and configure the System Manager settings to restrict unauthorized file uploads.\n\n * Network Security Recommendations: Minimize network exposure for PACS\n servers, ensuring they are not directly accessible from the internet.\n * Contact Information: Customers requiring additional support should contact INFINITT Security Team. (cybersecurity@infinitt.com)"
}
],
"source": {
"advisory": "ICSMA-25-100-01",
"discovery": "EXTERNAL"
},
"title": "INFINITT Healthcare INFINITT PACS Unrestricted Upload of File with Dangerous Type",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"assignerShortName": "icscert",
"cveId": "CVE-2025-27714",
"datePublished": "2025-08-21T19:42:59.699Z",
"dateReserved": "2025-03-19T16:39:28.817Z",
"dateUpdated": "2025-08-21T20:08:59.493Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-27721 (GCVE-0-2025-27721)
Vulnerability from nvd – Published: 2025-08-21 19:33 – Updated: 2025-08-22 15:50
VLAI
Title
INFINITT Healthcare INFINITT PACS Exposure of Sensitive System Information to an Unauthorized Control Sphere
Summary
Unauthorized users can access INFINITT PACS System Manager without proper authorization,
which could lead to unauthorized access to system resources.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| INFINITT Healthcare | INFINITT PACS System Manager |
Affected:
0 , ≤ 3.0.11.5 BN9
(custom)
Unaffected: 3.0.11.5 BN10 |
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-27721",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-08-22T15:50:46.203499Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-08-22T15:50:50.711Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "INFINITT PACS System Manager",
"vendor": "INFINITT Healthcare",
"versions": [
{
"lessThanOrEqual": "3.0.11.5 BN9",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "3.0.11.5 BN10"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Piotr Kijewski of the Shadowserver Foundation reported these vulnerabilities to CISA."
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Unauthorized users can access INFINITT PACS System Manager\u0026nbsp;without proper authorization, \nwhich could lead to unauthorized access to system resources."
}
],
"value": "Unauthorized users can access INFINITT PACS System Manager\u00a0without proper authorization, \nwhich could lead to unauthorized access to system resources."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-497",
"description": "CWE-497",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-08-21T19:33:03.503Z",
"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"shortName": "icscert"
},
"references": [
{
"url": "https://www.cisa.gov/news-events/ics-medical-advisories/icsma-25-100-01"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eINFINITT recommends the following mitigations:\u003c/p\u003e\n\u003cp\u003eThe latest version of the software (3.0.11.5 BN10 or later) is NOT affected, as it includes default security patches.\u003c/p\u003e\n\u003cp\u003eINFINITT ULite is NOT affected by these vulnerabilities. However, if \nINFINITT ULite is operating as an integrated system with INFINITT PACS, \npatching is required to secure the PACS environment.\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eFor CVE-2025-27714 and CVE-2025-24489: Apply the security patch and \nconfigure the System Manager settings to restrict unauthorized file \nuploads.\u003c/li\u003e\n\u003cli\u003eFor CVE-2025-27721: Apply the patch, enforce strong password \npolicies, and enable logging to monitor for unauthorized access \nattempts.\u003c/li\u003e\n\u003cli\u003eNetwork Security Recommendations: Minimize network exposure for PACS\n servers, ensuring they are not directly accessible from the internet.\u003c/li\u003e\u003cli\u003eContact Information: Customers requiring additional support should contact INFINITT Security Team. (\u003ca target=\"_blank\" rel=\"nofollow\"\u003ecybersecurity@infinitt.com\u003c/a\u003e)\n\n\u003cbr\u003e\u003c/li\u003e\u003c/ul\u003e"
}
],
"value": "INFINITT recommends the following mitigations:\n\n\nThe latest version of the software (3.0.11.5 BN10 or later) is NOT affected, as it includes default security patches.\n\n\nINFINITT ULite is NOT affected by these vulnerabilities. However, if \nINFINITT ULite is operating as an integrated system with INFINITT PACS, \npatching is required to secure the PACS environment.\n\n\n\n * For CVE-2025-27714 and CVE-2025-24489: Apply the security patch and \nconfigure the System Manager settings to restrict unauthorized file \nuploads.\n\n * For CVE-2025-27721: Apply the patch, enforce strong password \npolicies, and enable logging to monitor for unauthorized access \nattempts.\n\n * Network Security Recommendations: Minimize network exposure for PACS\n servers, ensuring they are not directly accessible from the internet.\n * Contact Information: Customers requiring additional support should contact INFINITT Security Team. (cybersecurity@infinitt.com)"
}
],
"source": {
"advisory": "ICSMA-25-100-01",
"discovery": "EXTERNAL"
},
"title": "INFINITT Healthcare INFINITT PACS Exposure of Sensitive System Information to an Unauthorized Control Sphere",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"assignerShortName": "icscert",
"cveId": "CVE-2025-27721",
"datePublished": "2025-08-21T19:33:03.503Z",
"dateReserved": "2025-03-19T16:39:28.803Z",
"dateUpdated": "2025-08-22T15:50:50.711Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}