Search criteria
6 vulnerabilities found for INFINITT PACS System Manager by INFINITT Healthcare
CVE-2025-24489 (GCVE-0-2025-24489)
Vulnerability from cvelistv5 – Published: 2025-08-21 19:44 – Updated: 2025-08-21 20:09
VLAI?
Title
INFINITT Healthcare INFINITT PACS Unrestricted Upload of File with Dangerous Type
Summary
An attacker could exploit this vulnerability by uploading arbitrary
files via a specific service, which could lead to system compromise.
Severity ?
6.3 (Medium)
CWE
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| INFINITT Healthcare | INFINITT PACS System Manager |
Affected:
0 , ≤ 3.0.11.5 BN9
(custom)
Unaffected: 3.0.11.5 BN10 |
Credits
Piotr Kijewski of the Shadowserver Foundation reported these vulnerabilities to CISA.
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-24489",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-08-21T20:09:30.758583Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-08-21T20:09:44.406Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "INFINITT PACS System Manager",
"vendor": "INFINITT Healthcare",
"versions": [
{
"lessThanOrEqual": "3.0.11.5 BN9",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "3.0.11.5 BN10"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Piotr Kijewski of the Shadowserver Foundation reported these vulnerabilities to CISA."
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "An attacker could exploit this vulnerability by uploading arbitrary \nfiles via a specific service, which could lead to system compromise."
}
],
"value": "An attacker could exploit this vulnerability by uploading arbitrary \nfiles via a specific service, which could lead to system compromise."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-434",
"description": "CWE-434",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-08-21T19:44:18.551Z",
"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"shortName": "icscert"
},
"references": [
{
"url": "https://www.cisa.gov/news-events/ics-medical-advisories/icsma-25-100-01"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eINFINITT recommends the following mitigations:\u003c/p\u003e\n\u003cp\u003eThe latest version of the software (3.0.11.5 BN10 or later) is NOT affected, as it includes default security patches.\u003c/p\u003e\n\u003cp\u003eINFINITT ULite is NOT affected by these vulnerabilities. However, if \nINFINITT ULite is operating as an integrated system with INFINITT PACS, \npatching is required to secure the PACS environment.\u003c/p\u003e\n\u003cul\u003e\u003cli\u003eApply the security patch and configure the System Manager settings to restrict unauthorized file uploads.\u003c/li\u003e\n\u003cli\u003eNetwork Security Recommendations: Minimize network exposure for PACS\n servers, ensuring they are not directly accessible from the internet.\u003c/li\u003e\u003cli\u003eContact Information: Customers requiring additional support should contact INFINITT Security Team. (\u003ca target=\"_blank\" rel=\"nofollow\"\u003ecybersecurity@infinitt.com\u003c/a\u003e)\n\n\u003cbr\u003e\u003c/li\u003e\u003c/ul\u003e"
}
],
"value": "INFINITT recommends the following mitigations:\n\n\nThe latest version of the software (3.0.11.5 BN10 or later) is NOT affected, as it includes default security patches.\n\n\nINFINITT ULite is NOT affected by these vulnerabilities. However, if \nINFINITT ULite is operating as an integrated system with INFINITT PACS, \npatching is required to secure the PACS environment.\n\n\n * Apply the security patch and configure the System Manager settings to restrict unauthorized file uploads.\n\n * Network Security Recommendations: Minimize network exposure for PACS\n servers, ensuring they are not directly accessible from the internet.\n * Contact Information: Customers requiring additional support should contact INFINITT Security Team. (cybersecurity@infinitt.com)"
}
],
"source": {
"advisory": "ICSMA-25-100-01",
"discovery": "EXTERNAL"
},
"title": "INFINITT Healthcare INFINITT PACS Unrestricted Upload of File with Dangerous Type",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"assignerShortName": "icscert",
"cveId": "CVE-2025-24489",
"datePublished": "2025-08-21T19:44:18.551Z",
"dateReserved": "2025-03-19T16:39:28.811Z",
"dateUpdated": "2025-08-21T20:09:44.406Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-27714 (GCVE-0-2025-27714)
Vulnerability from cvelistv5 – Published: 2025-08-21 19:42 – Updated: 2025-08-21 20:08
VLAI?
Title
INFINITT Healthcare INFINITT PACS Unrestricted Upload of File with Dangerous Type
Summary
An attacker could exploit this vulnerability by uploading arbitrary
files via the a specific endpoint, leading to unauthorized remote code
execution or system compromise.
Severity ?
6.3 (Medium)
CWE
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| INFINITT Healthcare | INFINITT PACS System Manager |
Affected:
0 , ≤ 3.0.11.5 BN9
(custom)
Unaffected: 3.0.11.5 BN10 |
Credits
Piotr Kijewski of the Shadowserver Foundation reported these vulnerabilities to CISA.
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-27714",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-08-21T20:08:49.089078Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-08-21T20:08:59.493Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "INFINITT PACS System Manager",
"vendor": "INFINITT Healthcare",
"versions": [
{
"lessThanOrEqual": "3.0.11.5 BN9",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "3.0.11.5 BN10"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Piotr Kijewski of the Shadowserver Foundation reported these vulnerabilities to CISA."
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "An attacker could exploit this vulnerability by uploading arbitrary \nfiles via the a specific endpoint, leading to unauthorized remote code \nexecution or system compromise."
}
],
"value": "An attacker could exploit this vulnerability by uploading arbitrary \nfiles via the a specific endpoint, leading to unauthorized remote code \nexecution or system compromise."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-434",
"description": "CWE-434",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-08-21T19:42:59.699Z",
"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"shortName": "icscert"
},
"references": [
{
"url": "https://www.cisa.gov/news-events/ics-medical-advisories/icsma-25-100-01"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eINFINITT recommends the following mitigations:\u003c/p\u003e\n\u003cp\u003eThe latest version of the software (3.0.11.5 BN10 or later) is NOT affected, as it includes default security patches.\u003c/p\u003e\n\u003cp\u003eINFINITT ULite is NOT affected by these vulnerabilities. However, if \nINFINITT ULite is operating as an integrated system with INFINITT PACS, \npatching is required to secure the PACS environment.\u003c/p\u003e\n\u003cul\u003e\u003cli\u003eApply the security patch and configure the System Manager settings to restrict unauthorized file uploads.\u003c/li\u003e\n\u003cli\u003eNetwork Security Recommendations: Minimize network exposure for PACS\n servers, ensuring they are not directly accessible from the internet.\u003c/li\u003e\u003cli\u003eContact Information: Customers requiring additional support should contact INFINITT Security Team. (\u003ca target=\"_blank\" rel=\"nofollow\"\u003ecybersecurity@infinitt.com\u003c/a\u003e)\n\n\u003cbr\u003e\u003c/li\u003e\u003c/ul\u003e"
}
],
"value": "INFINITT recommends the following mitigations:\n\n\nThe latest version of the software (3.0.11.5 BN10 or later) is NOT affected, as it includes default security patches.\n\n\nINFINITT ULite is NOT affected by these vulnerabilities. However, if \nINFINITT ULite is operating as an integrated system with INFINITT PACS, \npatching is required to secure the PACS environment.\n\n\n * Apply the security patch and configure the System Manager settings to restrict unauthorized file uploads.\n\n * Network Security Recommendations: Minimize network exposure for PACS\n servers, ensuring they are not directly accessible from the internet.\n * Contact Information: Customers requiring additional support should contact INFINITT Security Team. (cybersecurity@infinitt.com)"
}
],
"source": {
"advisory": "ICSMA-25-100-01",
"discovery": "EXTERNAL"
},
"title": "INFINITT Healthcare INFINITT PACS Unrestricted Upload of File with Dangerous Type",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"assignerShortName": "icscert",
"cveId": "CVE-2025-27714",
"datePublished": "2025-08-21T19:42:59.699Z",
"dateReserved": "2025-03-19T16:39:28.817Z",
"dateUpdated": "2025-08-21T20:08:59.493Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-27721 (GCVE-0-2025-27721)
Vulnerability from cvelistv5 – Published: 2025-08-21 19:33 – Updated: 2025-08-22 15:50
VLAI?
Title
INFINITT Healthcare INFINITT PACS Exposure of Sensitive System Information to an Unauthorized Control Sphere
Summary
Unauthorized users can access INFINITT PACS System Manager without proper authorization,
which could lead to unauthorized access to system resources.
Severity ?
CWE
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| INFINITT Healthcare | INFINITT PACS System Manager |
Affected:
0 , ≤ 3.0.11.5 BN9
(custom)
Unaffected: 3.0.11.5 BN10 |
Credits
Piotr Kijewski of the Shadowserver Foundation reported these vulnerabilities to CISA.
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-27721",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-08-22T15:50:46.203499Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-08-22T15:50:50.711Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "INFINITT PACS System Manager",
"vendor": "INFINITT Healthcare",
"versions": [
{
"lessThanOrEqual": "3.0.11.5 BN9",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "3.0.11.5 BN10"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Piotr Kijewski of the Shadowserver Foundation reported these vulnerabilities to CISA."
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Unauthorized users can access INFINITT PACS System Manager\u0026nbsp;without proper authorization, \nwhich could lead to unauthorized access to system resources."
}
],
"value": "Unauthorized users can access INFINITT PACS System Manager\u00a0without proper authorization, \nwhich could lead to unauthorized access to system resources."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-497",
"description": "CWE-497",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-08-21T19:33:03.503Z",
"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"shortName": "icscert"
},
"references": [
{
"url": "https://www.cisa.gov/news-events/ics-medical-advisories/icsma-25-100-01"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eINFINITT recommends the following mitigations:\u003c/p\u003e\n\u003cp\u003eThe latest version of the software (3.0.11.5 BN10 or later) is NOT affected, as it includes default security patches.\u003c/p\u003e\n\u003cp\u003eINFINITT ULite is NOT affected by these vulnerabilities. However, if \nINFINITT ULite is operating as an integrated system with INFINITT PACS, \npatching is required to secure the PACS environment.\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eFor CVE-2025-27714 and CVE-2025-24489: Apply the security patch and \nconfigure the System Manager settings to restrict unauthorized file \nuploads.\u003c/li\u003e\n\u003cli\u003eFor CVE-2025-27721: Apply the patch, enforce strong password \npolicies, and enable logging to monitor for unauthorized access \nattempts.\u003c/li\u003e\n\u003cli\u003eNetwork Security Recommendations: Minimize network exposure for PACS\n servers, ensuring they are not directly accessible from the internet.\u003c/li\u003e\u003cli\u003eContact Information: Customers requiring additional support should contact INFINITT Security Team. (\u003ca target=\"_blank\" rel=\"nofollow\"\u003ecybersecurity@infinitt.com\u003c/a\u003e)\n\n\u003cbr\u003e\u003c/li\u003e\u003c/ul\u003e"
}
],
"value": "INFINITT recommends the following mitigations:\n\n\nThe latest version of the software (3.0.11.5 BN10 or later) is NOT affected, as it includes default security patches.\n\n\nINFINITT ULite is NOT affected by these vulnerabilities. However, if \nINFINITT ULite is operating as an integrated system with INFINITT PACS, \npatching is required to secure the PACS environment.\n\n\n\n * For CVE-2025-27714 and CVE-2025-24489: Apply the security patch and \nconfigure the System Manager settings to restrict unauthorized file \nuploads.\n\n * For CVE-2025-27721: Apply the patch, enforce strong password \npolicies, and enable logging to monitor for unauthorized access \nattempts.\n\n * Network Security Recommendations: Minimize network exposure for PACS\n servers, ensuring they are not directly accessible from the internet.\n * Contact Information: Customers requiring additional support should contact INFINITT Security Team. (cybersecurity@infinitt.com)"
}
],
"source": {
"advisory": "ICSMA-25-100-01",
"discovery": "EXTERNAL"
},
"title": "INFINITT Healthcare INFINITT PACS Exposure of Sensitive System Information to an Unauthorized Control Sphere",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"assignerShortName": "icscert",
"cveId": "CVE-2025-27721",
"datePublished": "2025-08-21T19:33:03.503Z",
"dateReserved": "2025-03-19T16:39:28.803Z",
"dateUpdated": "2025-08-22T15:50:50.711Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-24489 (GCVE-0-2025-24489)
Vulnerability from nvd – Published: 2025-08-21 19:44 – Updated: 2025-08-21 20:09
VLAI?
Title
INFINITT Healthcare INFINITT PACS Unrestricted Upload of File with Dangerous Type
Summary
An attacker could exploit this vulnerability by uploading arbitrary
files via a specific service, which could lead to system compromise.
Severity ?
6.3 (Medium)
CWE
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| INFINITT Healthcare | INFINITT PACS System Manager |
Affected:
0 , ≤ 3.0.11.5 BN9
(custom)
Unaffected: 3.0.11.5 BN10 |
Credits
Piotr Kijewski of the Shadowserver Foundation reported these vulnerabilities to CISA.
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-24489",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-08-21T20:09:30.758583Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-08-21T20:09:44.406Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "INFINITT PACS System Manager",
"vendor": "INFINITT Healthcare",
"versions": [
{
"lessThanOrEqual": "3.0.11.5 BN9",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "3.0.11.5 BN10"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Piotr Kijewski of the Shadowserver Foundation reported these vulnerabilities to CISA."
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "An attacker could exploit this vulnerability by uploading arbitrary \nfiles via a specific service, which could lead to system compromise."
}
],
"value": "An attacker could exploit this vulnerability by uploading arbitrary \nfiles via a specific service, which could lead to system compromise."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-434",
"description": "CWE-434",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-08-21T19:44:18.551Z",
"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"shortName": "icscert"
},
"references": [
{
"url": "https://www.cisa.gov/news-events/ics-medical-advisories/icsma-25-100-01"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eINFINITT recommends the following mitigations:\u003c/p\u003e\n\u003cp\u003eThe latest version of the software (3.0.11.5 BN10 or later) is NOT affected, as it includes default security patches.\u003c/p\u003e\n\u003cp\u003eINFINITT ULite is NOT affected by these vulnerabilities. However, if \nINFINITT ULite is operating as an integrated system with INFINITT PACS, \npatching is required to secure the PACS environment.\u003c/p\u003e\n\u003cul\u003e\u003cli\u003eApply the security patch and configure the System Manager settings to restrict unauthorized file uploads.\u003c/li\u003e\n\u003cli\u003eNetwork Security Recommendations: Minimize network exposure for PACS\n servers, ensuring they are not directly accessible from the internet.\u003c/li\u003e\u003cli\u003eContact Information: Customers requiring additional support should contact INFINITT Security Team. (\u003ca target=\"_blank\" rel=\"nofollow\"\u003ecybersecurity@infinitt.com\u003c/a\u003e)\n\n\u003cbr\u003e\u003c/li\u003e\u003c/ul\u003e"
}
],
"value": "INFINITT recommends the following mitigations:\n\n\nThe latest version of the software (3.0.11.5 BN10 or later) is NOT affected, as it includes default security patches.\n\n\nINFINITT ULite is NOT affected by these vulnerabilities. However, if \nINFINITT ULite is operating as an integrated system with INFINITT PACS, \npatching is required to secure the PACS environment.\n\n\n * Apply the security patch and configure the System Manager settings to restrict unauthorized file uploads.\n\n * Network Security Recommendations: Minimize network exposure for PACS\n servers, ensuring they are not directly accessible from the internet.\n * Contact Information: Customers requiring additional support should contact INFINITT Security Team. (cybersecurity@infinitt.com)"
}
],
"source": {
"advisory": "ICSMA-25-100-01",
"discovery": "EXTERNAL"
},
"title": "INFINITT Healthcare INFINITT PACS Unrestricted Upload of File with Dangerous Type",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"assignerShortName": "icscert",
"cveId": "CVE-2025-24489",
"datePublished": "2025-08-21T19:44:18.551Z",
"dateReserved": "2025-03-19T16:39:28.811Z",
"dateUpdated": "2025-08-21T20:09:44.406Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-27714 (GCVE-0-2025-27714)
Vulnerability from nvd – Published: 2025-08-21 19:42 – Updated: 2025-08-21 20:08
VLAI?
Title
INFINITT Healthcare INFINITT PACS Unrestricted Upload of File with Dangerous Type
Summary
An attacker could exploit this vulnerability by uploading arbitrary
files via the a specific endpoint, leading to unauthorized remote code
execution or system compromise.
Severity ?
6.3 (Medium)
CWE
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| INFINITT Healthcare | INFINITT PACS System Manager |
Affected:
0 , ≤ 3.0.11.5 BN9
(custom)
Unaffected: 3.0.11.5 BN10 |
Credits
Piotr Kijewski of the Shadowserver Foundation reported these vulnerabilities to CISA.
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-27714",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-08-21T20:08:49.089078Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-08-21T20:08:59.493Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "INFINITT PACS System Manager",
"vendor": "INFINITT Healthcare",
"versions": [
{
"lessThanOrEqual": "3.0.11.5 BN9",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "3.0.11.5 BN10"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Piotr Kijewski of the Shadowserver Foundation reported these vulnerabilities to CISA."
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "An attacker could exploit this vulnerability by uploading arbitrary \nfiles via the a specific endpoint, leading to unauthorized remote code \nexecution or system compromise."
}
],
"value": "An attacker could exploit this vulnerability by uploading arbitrary \nfiles via the a specific endpoint, leading to unauthorized remote code \nexecution or system compromise."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-434",
"description": "CWE-434",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-08-21T19:42:59.699Z",
"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"shortName": "icscert"
},
"references": [
{
"url": "https://www.cisa.gov/news-events/ics-medical-advisories/icsma-25-100-01"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eINFINITT recommends the following mitigations:\u003c/p\u003e\n\u003cp\u003eThe latest version of the software (3.0.11.5 BN10 or later) is NOT affected, as it includes default security patches.\u003c/p\u003e\n\u003cp\u003eINFINITT ULite is NOT affected by these vulnerabilities. However, if \nINFINITT ULite is operating as an integrated system with INFINITT PACS, \npatching is required to secure the PACS environment.\u003c/p\u003e\n\u003cul\u003e\u003cli\u003eApply the security patch and configure the System Manager settings to restrict unauthorized file uploads.\u003c/li\u003e\n\u003cli\u003eNetwork Security Recommendations: Minimize network exposure for PACS\n servers, ensuring they are not directly accessible from the internet.\u003c/li\u003e\u003cli\u003eContact Information: Customers requiring additional support should contact INFINITT Security Team. (\u003ca target=\"_blank\" rel=\"nofollow\"\u003ecybersecurity@infinitt.com\u003c/a\u003e)\n\n\u003cbr\u003e\u003c/li\u003e\u003c/ul\u003e"
}
],
"value": "INFINITT recommends the following mitigations:\n\n\nThe latest version of the software (3.0.11.5 BN10 or later) is NOT affected, as it includes default security patches.\n\n\nINFINITT ULite is NOT affected by these vulnerabilities. However, if \nINFINITT ULite is operating as an integrated system with INFINITT PACS, \npatching is required to secure the PACS environment.\n\n\n * Apply the security patch and configure the System Manager settings to restrict unauthorized file uploads.\n\n * Network Security Recommendations: Minimize network exposure for PACS\n servers, ensuring they are not directly accessible from the internet.\n * Contact Information: Customers requiring additional support should contact INFINITT Security Team. (cybersecurity@infinitt.com)"
}
],
"source": {
"advisory": "ICSMA-25-100-01",
"discovery": "EXTERNAL"
},
"title": "INFINITT Healthcare INFINITT PACS Unrestricted Upload of File with Dangerous Type",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"assignerShortName": "icscert",
"cveId": "CVE-2025-27714",
"datePublished": "2025-08-21T19:42:59.699Z",
"dateReserved": "2025-03-19T16:39:28.817Z",
"dateUpdated": "2025-08-21T20:08:59.493Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-27721 (GCVE-0-2025-27721)
Vulnerability from nvd – Published: 2025-08-21 19:33 – Updated: 2025-08-22 15:50
VLAI?
Title
INFINITT Healthcare INFINITT PACS Exposure of Sensitive System Information to an Unauthorized Control Sphere
Summary
Unauthorized users can access INFINITT PACS System Manager without proper authorization,
which could lead to unauthorized access to system resources.
Severity ?
CWE
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| INFINITT Healthcare | INFINITT PACS System Manager |
Affected:
0 , ≤ 3.0.11.5 BN9
(custom)
Unaffected: 3.0.11.5 BN10 |
Credits
Piotr Kijewski of the Shadowserver Foundation reported these vulnerabilities to CISA.
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-27721",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-08-22T15:50:46.203499Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-08-22T15:50:50.711Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "INFINITT PACS System Manager",
"vendor": "INFINITT Healthcare",
"versions": [
{
"lessThanOrEqual": "3.0.11.5 BN9",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "3.0.11.5 BN10"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Piotr Kijewski of the Shadowserver Foundation reported these vulnerabilities to CISA."
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Unauthorized users can access INFINITT PACS System Manager\u0026nbsp;without proper authorization, \nwhich could lead to unauthorized access to system resources."
}
],
"value": "Unauthorized users can access INFINITT PACS System Manager\u00a0without proper authorization, \nwhich could lead to unauthorized access to system resources."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-497",
"description": "CWE-497",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-08-21T19:33:03.503Z",
"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"shortName": "icscert"
},
"references": [
{
"url": "https://www.cisa.gov/news-events/ics-medical-advisories/icsma-25-100-01"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eINFINITT recommends the following mitigations:\u003c/p\u003e\n\u003cp\u003eThe latest version of the software (3.0.11.5 BN10 or later) is NOT affected, as it includes default security patches.\u003c/p\u003e\n\u003cp\u003eINFINITT ULite is NOT affected by these vulnerabilities. However, if \nINFINITT ULite is operating as an integrated system with INFINITT PACS, \npatching is required to secure the PACS environment.\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eFor CVE-2025-27714 and CVE-2025-24489: Apply the security patch and \nconfigure the System Manager settings to restrict unauthorized file \nuploads.\u003c/li\u003e\n\u003cli\u003eFor CVE-2025-27721: Apply the patch, enforce strong password \npolicies, and enable logging to monitor for unauthorized access \nattempts.\u003c/li\u003e\n\u003cli\u003eNetwork Security Recommendations: Minimize network exposure for PACS\n servers, ensuring they are not directly accessible from the internet.\u003c/li\u003e\u003cli\u003eContact Information: Customers requiring additional support should contact INFINITT Security Team. (\u003ca target=\"_blank\" rel=\"nofollow\"\u003ecybersecurity@infinitt.com\u003c/a\u003e)\n\n\u003cbr\u003e\u003c/li\u003e\u003c/ul\u003e"
}
],
"value": "INFINITT recommends the following mitigations:\n\n\nThe latest version of the software (3.0.11.5 BN10 or later) is NOT affected, as it includes default security patches.\n\n\nINFINITT ULite is NOT affected by these vulnerabilities. However, if \nINFINITT ULite is operating as an integrated system with INFINITT PACS, \npatching is required to secure the PACS environment.\n\n\n\n * For CVE-2025-27714 and CVE-2025-24489: Apply the security patch and \nconfigure the System Manager settings to restrict unauthorized file \nuploads.\n\n * For CVE-2025-27721: Apply the patch, enforce strong password \npolicies, and enable logging to monitor for unauthorized access \nattempts.\n\n * Network Security Recommendations: Minimize network exposure for PACS\n servers, ensuring they are not directly accessible from the internet.\n * Contact Information: Customers requiring additional support should contact INFINITT Security Team. (cybersecurity@infinitt.com)"
}
],
"source": {
"advisory": "ICSMA-25-100-01",
"discovery": "EXTERNAL"
},
"title": "INFINITT Healthcare INFINITT PACS Exposure of Sensitive System Information to an Unauthorized Control Sphere",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"assignerShortName": "icscert",
"cveId": "CVE-2025-27721",
"datePublished": "2025-08-21T19:33:03.503Z",
"dateReserved": "2025-03-19T16:39:28.803Z",
"dateUpdated": "2025-08-22T15:50:50.711Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}