{"vuid":"VU#203719","idnumber":"203719","name":"INFINITT PACS System Manager Contains Multiple Code Execution Vulnerabilities","keywords":null,"overview":"### Overview\r\nINFINITT PACS installations using System Manager versions 3.0.11.3 and 3.0.11.5 contain vulnerabilities that may allow an attacker to execute arbitrary code. INFINITT Healthcare has remediated the issues in System Manager versions 3.0.12.3 and 3.0.12.5.\r\n\r\n### Description\r\nINFINITT PACS is an enterprise web-based medical imaging platform that stores, retrieves, and displays patient scans. \r\n\r\n**CVE-2026-16305**  \r\nAn improperly protected update manifest may allow a local attacker to execute commands with administrative privileges when an update is approved.  \r\n`SmartExecute.exe` reads and runs commands from `execlist.txt` after an update. Because of insecure file permissions on `execlist.txt`, a low-privileged attacker can modify the file before it is processed to add arbitrary malicious commands. After `SmartUpdate.exe` launches, it runs `SmartExecute.exe` and the user can be prompted by User Account Control (UAC), which can allow the malicious command to execute with administrative privileges.\r\n\r\n**CVE-2026-16306**   \r\nAn unsafe command dispatch through the registered `imodular://` URI scheme may result in code execution.  \r\nA vulnerability in `IModular.exe` allows an attacker to execute certain application functions by supplying a crafted `imodular://` link. The application reads the `cmd` value from the link and executes the corresponding function without verifying that the command is permitted or safe. By convincing an end user to open a crafted `imodular://` link, an attacker can cause `IModular.exe` to access attacker-controlled files or run specific programs from a local folder or network share. The link also accepts a `url` parameter that causes `IModular.exe` to connect to an attacker-controlled SignalR endpoint, creating an unauthorized outbound connection.\r\n\r\n### Impact\r\nSuccessful exploitation of CVE-2026-16305 may allow a local, low-privileged attacker to execute arbitrary commands with administrative privileges on the affected workstation. An attacker could then install or modify software, access protected files, disable security controls, or establish persistent access to the system.\r\nSuccessful exploitation of CVE-2026-16306 may allow a remote attacker to execute code with the privileges of the affected user, access or modify data available to that user, and use the compromised workstation as a foothold for further attacks. The vulnerability may allow unauthorized outbound communication with an attacker-controlled SignalR server, potentially exposing sensitive information or enabling additional malicious activity.\r\n\r\n### Solution\r\nThere are no indications that these vulnerabilities have been exploited. INFINITT Healthcare recommends upgrading affected installations to one of the following fixed System Manager versions:\r\n\r\n* System Manager 3.0.12.3\r\n* System Manager 3.0.12.5\r\n\r\nOrganizations should apply the appropriate update as soon as operationally feasible.\r\n\r\n### Acknowledgements\r\nThanks to Piotr Berlinski from CyberArms.io for identifying these vulnerabilities, and to INFINITT for quickly addressing the problems. This document was written by Michael Bragg.","clean_desc":null,"impact":null,"resolution":null,"workarounds":null,"sysaffected":null,"thanks":null,"author":null,"public":["https://www.infinittna.com/"],"cveids":["CVE-2026-16306","CVE-2026-16305"],"certadvisory":null,"uscerttechnicalalert":null,"datecreated":"2026-11-02T15:38:19.414694Z","publicdate":"2026-11-02T15:38:19.227086Z","datefirstpublished":"2026-11-02T15:38:19.438399Z","dateupdated":"2026-11-02T15:38:19.227082Z","revision":1,"vrda_d1_directreport":null,"vrda_d1_population":null,"vrda_d1_impact":null,"cam_widelyknown":null,"cam_exploitation":null,"cam_internetinfrastructure":null,"cam_population":null,"cam_impact":null,"cam_easeofexploitation":null,"cam_attackeraccessrequired":null,"cam_scorecurrent":null,"cam_scorecurrentwidelyknown":null,"cam_scorecurrentwidelyknownexploited":null,"ipprotocol":null,"cvss_accessvector":null,"cvss_accesscomplexity":null,"cvss_authentication":null,"cvss_confidentialityimpact":null,"cvss_integrityimpact":null,"cvss_availabilityimpact":null,"cvss_exploitablity":null,"cvss_remediationlevel":null,"cvss_reportconfidence":null,"cvss_collateraldamagepotential":null,"cvss_targetdistribution":null,"cvss_securityrequirementscr":null,"cvss_securityrequirementsir":null,"cvss_securityrequirementsar":null,"cvss_basescore":null,"cvss_basevector":null,"cvss_temporalscore":null,"cvss_environmentalscore":null,"cvss_environmentalvector":null,"metric":null,"vulnote":269}