{"id":"CVE-2026-16305","kind":"vulnerability","aliases":["CVE-2026-16305"],"related":[],"title":"INFINITT PACS: local users can run commands as administrator via update manifest","description":"Local privilege escalation in `SmartUpdate.exe` and `SmartExecute.exe` in INFINITT Healthcare Co., Ltd. INFINITT PACS allows a local low-privileged attacker to execute arbitrary commands with administrator privileges via modification of a world-writable `execlist.txt` command manifest that is processed during application updates.","summary":"INFINITT PACS medical imaging software has a local privilege escalation flaw in SmartUpdate.exe and SmartExecute.exe. A low-privileged local user who edits the world-writable execlist.txt command manifest can get arbitrary commands run with administrator rights during an application update.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"INFINITT PACS System Manager","fixed":["3.0.12.3","3.0.12.5"],"affected":">= 3.0.11.3, <= 3.0.11.5","ecosystem":"vendor"}],"ecosystems":[],"tags":["healthcare","infinitt-pacs","on-prem","other","windows"],"not_affected_if":["execlist-not-world-writable","no-local-user-accounts"],"how_to_check":"- Check the installed System Manager version: 3.0.11.3 and 3.0.11.5 are listed as affected; 3.0.12.3 and 3.0.12.5 as fixed.\n- Look for execlist.txt under the INFINITT PACS install directory and check whether non-admin users can write to it.\n- Check whether SmartUpdate.exe and SmartExecute.exe are present.","fix":"Upgrade INFINITT PACS System Manager to 3.0.12.3 or 3.0.12.5 (per CERT/CC VU#203719, relaying INFINITT Healthcare's recommendation).","status":"open","published_at":"2026-11-02T21:17:30+00:00","first_seen_at":"2026-11-02T21:35:41+00:00","triaged_at":"2026-11-02T21:37:20+00:00","updated_at":"2026-11-02T21:38:33+00:00","category":"other","confidence":0.8,"triage":{"at":"2026-11-02T21:37:20Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"INFINITT PACS: local users can run commands as administrator via update manifest","impact":"high","summary":"INFINITT PACS medical imaging software has a local privilege escalation flaw in SmartUpdate.exe and SmartExecute.exe. A low-privileged local user who edits the world-writable execlist.txt command manifest can get arbitrary commands run with administrator rights during an application update.","audience":"businesses","category":"other","nicknames":[],"who_cares":["infinitt-pacs","windows","healthcare","on-prem"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"local user gains administrator command execution on the Windows machine","analyst_note":"Find affected INFINITT PACS versions and the vendor's fixed build; the NVD entry gives no version ranges or fix.","how_to_check":"- Look for `execlist.txt` under the INFINITT PACS install directory and check whether non-admin users have write permission on it\n- Check whether `SmartUpdate.exe` and `SmartExecute.exe` are present in the install\n- Confirm the installed INFINITT PACS version against the vendor's advisory (unknown from the sources)","plain_action":"","needs_analyst":true,"not_affected_if":["no-local-user-accounts","execlist-not-world-writable"],"who_is_affected":"Hospitals and clinics that run INFINITT PACS on Windows workstations or servers where more than one user can log in. The flaw needs a local account on the machine, so single-user systems with no other accounts are lower risk. The sources do not name affected versions.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000715,"input_tokens":4150,"output_tokens":599,"severity_before":"unknown"},"analyst_status":"done","analyst_note":"Find affected INFINITT PACS versions and the vendor's fixed build; the NVD entry gives no version ranges or fix.","search":"'-16305':15A,18A '-2026':14A,17A 'administr':9A,68B,100C 'allow':88C 'applic':72B,116C 'arbitrari':64B,97C 'attack':94C 'co':84C 'command':7A,60B,65B,98C,110C 'cve':13A,16A 'edit':54B 'escal':41B,76C 'execlist.txt':59B,109C 'execut':96C 'flaw':42B 'get':63B 'healthcar':23B,83C 'imag':35B 'infinitt':1A,19A,25B,32B,82C,86C 'infinitt-pac':24B 'local':3A,39B,51B,74C,90C 'low':49B,92C 'low-privileg':48B,91C 'ltd':85C 'manager':22A 'manifest':12A,61B,111C 'medic':34B 'modif':103C 'on-prem':27B 'pac':2A,26B,33B,87C 'pacs':20A 'prem':29B 'privileg':40B,50B,75C,93C,101C 'process':114C 'right':69B 'run':6A,66B 'smartexecute.exe':46B,80C 'smartupdate.exe':44B,78C 'softwar':36B 'system':21A 'updat':11A,73B,117C 'user':4A,52B 'via':10A,102C 'window':31B 'world':57B,107C 'world-writ':56B,106C 'writabl':58B,108C","nicknames":[],"mitigations":[],"who_affected":"Hospitals and clinics running INFINITT PACS System Manager 3.0.11.3 or 3.0.11.5 on Windows workstations or servers where low-privileged users can log in. The attacker needs a local account and edits execlist.txt before an update is approved; SmartExecute.exe then runs the commands with administrative rights, possibly after a UAC prompt. Systems already on 3.0.12.3 or 3.0.12.5, or without other local users, can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["infinittpacssystemmanager","pacssystemmanager"],"ptokens":["infinitt","manager","pacs","system"],"labels":["healthcare","high","infinittpacs","onprem","other","windows"],"first_public_at":"2026-11-02T21:17:30+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-16305","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-16305","severity":null,"published_at":"2026-11-02T21:17:30+00:00","modified_at":"2026-11-02T21:17:30+00:00","first_seen_at":"2026-11-02T21:35:41+00:00","fetched_at":"2026-11-02T21:35:41+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-16305:1432","url":null,"severity":null,"published_at":"2026-11-02T21:38:33+00:00","modified_at":"2026-11-02T21:38:33+00:00","first_seen_at":"2026-11-02T21:38:33+00:00","fetched_at":"2026-11-02T21:38:33+00:00","note":"Read CERT/CC VU#203719 (coordinator page, not vendor's own; vendor statement not received, so nothing marked verified). Affected 3.0.11.3/3.0.11.5, fixed 3.0.12.3/3.0.12.5. No known exploitation per CERT. Same note covers CVE-2026-16306 (imodular:// URI), a sibling."}],"documents":[{"id":54004,"url":"https://www.kb.cert.org/vuls/id/203719","title":"VU#203719 INFINITT PACS System Manager Contains Multiple Code Execution Vulnerabilities","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}