{"id":"CVE-2026-16306","kind":"vulnerability","aliases":["CVE-2026-16306"],"related":[],"title":"INFINITT PACS: crafted imodular URI lets an attacker run code","description":"Remote Code Execution in the `IModular.exe` URI handler in INFINITT Healthcare Co., Ltd. INFINITT PACS allows a remote unauthenticated attacker to invoke unintended application functionality and potentially execute arbitrary code via a crafted `imodular:// URI` containing attacker-controlled command and argument parameters.","summary":"IModular.exe, the handler for the imodular:// URI scheme in INFINITT PACS, runs the cmd value from a link without checking that it is permitted. If a user opens a crafted link, an attacker can make it run specific programs from a local folder or network share, or open files the attacker controls. The url parameter also makes it connect to an attacker-controlled SignalR endpoint. Code runs with that user's privileges. CERT/CC reports no known exploitation.","severity":"critical","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"INFINITT PACS System Manager","fixed":["3.0.12.3","3.0.12.5"],"affected":"3.0.11.3, 3.0.11.5","ecosystem":"vendor"}],"ecosystems":[],"tags":["healthcare","imaging","infinitt-pacs","user-interaction","vendor","windows"],"not_affected_if":["fixed-version","no-imodular-handler","not-installed"],"how_to_check":"- Check System Manager version on INFINITT PACS hosts and workstations: 3.0.11.3 and 3.0.11.5 are affected; 3.0.12.3 and 3.0.12.5 are fixed.\n- Check whether IModular.exe is present in the install directory and whether the imodular:// scheme is registered (HKCR\\imodular).","fix":"Upgrade INFINITT PACS System Manager to 3.0.12.3 or 3.0.12.5 (per CERT/CC VU#203719, relaying INFINITT's recommendation).","status":"open","published_at":"2026-11-02T16:17:34+00:00","first_seen_at":"2026-11-02T16:24:04+00:00","triaged_at":"2026-11-02T16:27:06+00:00","updated_at":"2026-11-02T16:28:21+00:00","category":"vendor","confidence":0.75,"triage":{"at":"2026-11-02T16:27:06Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"INFINITT PACS: crafted imodular URI lets an attacker run code","impact":"high","summary":"INFINITT PACS registers an imodular:// URI handler through IModular.exe that accepts attacker-supplied command and argument parameters. A remote attacker with no account can craft a link that triggers unintended functions and may execute arbitrary code on the machine.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["infinitt-pacs","windows","healthcare","imaging"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker runs arbitrary code on the workstation or server","analyst_note":"Find the vendor advisory and the list of affected and fixed INFINITT PACS versions; confirm whether a click is required to trigger the URI.","how_to_check":"- Check whether INFINITT PACS is installed on Windows machines and whether IModular.exe is present in its install directory.\n- Check whether the imodular:// URI scheme is registered for the current user or machine.\n- unknown for vendor-specific version ranges, as the sources do not list affected versions.","plain_action":"","needs_analyst":true,"not_affected_if":["not-installed","no-imodular-handler"],"who_is_affected":"Hospitals and clinics that run INFINITT PACS on Windows workstations or servers are exposed when the imodular:// handler is present. A user with a crafted link opened in a browser or document is the likely delivery path. Systems without INFINITT PACS installed are not affected.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000707,"input_tokens":4137,"output_tokens":586,"severity_before":"unknown"},"analyst_status":"done","analyst_note":"Find the vendor advisory and the list of affected and fixed INFINITT PACS versions; confirm whether a click is required to trigger the URI.","search":"'-16306':13A,16A '-2026':12A,15A 'allow':123C 'also':85B 'applic':131C 'arbitrari':136C 'argument':148C 'attack':8A,62B,80B,92B,127C,144C 'attacker-control':91B,143C 'cert/cc':103B 'check':49B 'cmd':43B 'co':119C 'code':10A,96B,109C,137C 'command':146C 'connect':88B 'contain':142C 'control':81B,93B,145C 'craft':3A,59B,140C 'cve':11A,14A 'endpoint':95B 'execut':110C,135C 'exploit':107B 'file':78B 'folder':72B 'function':132C 'handler':33B,115C 'healthcar':21B,118C 'imag':22B 'imodular':4A 'imodular.exe':31B,113C 'infinitt':1A,17A,24B,39B,117C,121C 'infinitt-pac':23B 'interact':28B 'invok':129C 'known':106B 'let':6A 'link':47B,60B 'local':71B 'ltd':120C 'make':64B,86B 'manager':20A 'network':74B 'open':57B,77B 'pac':2A,25B,40B,122C 'pacs':18A 'paramet':84B,149C 'permit':53B 'potenti':134C 'privileg':102B 'program':68B 'remot':108C,125C 'report':104B 'run':9A,41B,66B,97B 'scheme':37B 'share':75B 'signalr':94B 'specif':67B 'system':19A 'unauthent':126C 'unintend':130C 'uri':5A,36B,114C,141C 'url':83B 'user':27B,56B,100B 'user-interact':26B 'valu':44B 'vendor':29B 'via':138C 'window':30B 'without':48B","nicknames":[],"mitigations":[],"who_affected":"Hospitals and clinics running INFINITT PACS System Manager 3.0.11.3 or 3.0.11.5 on Windows workstations where IModular.exe registers the imodular:// handler. Exploitation needs a user to open a crafted imodular:// link (browser, email or document), and code then runs with that user's privileges. Systems without INFINITT PACS, or already on 3.0.12.3/3.0.12.5, can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["infinittpacssystemmanager","pacssystemmanager"],"ptokens":["infinitt","manager","pacs","system"],"labels":["critical","healthcare","imaging","infinittpacs","userinteraction","vendor","windows"],"first_public_at":"2026-11-02T16:17:34+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-16306","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-16306","severity":null,"published_at":"2026-11-02T16:17:34+00:00","modified_at":"2026-11-02T16:17:34+00:00","first_seen_at":"2026-11-02T16:24:04+00:00","fetched_at":"2026-11-02T16:24:04+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-16306:1390","url":null,"severity":null,"published_at":"2026-11-02T16:28:21+00:00","modified_at":"2026-11-02T16:28:21+00:00","first_seen_at":"2026-11-02T16:28:21+00:00","fetched_at":"2026-11-02T16:28:21+00:00","note":"Read CERT/CC VU#203719 (coordinator, not vendor; vendor statement absent, so nothing marked verified). Click required: user must open crafted imodular:// link. Fixed in System Manager 3.0.12.3/3.0.12.5 per CERT. No exploitation known per CERT."}],"documents":[{"id":52852,"url":"https://kb.cert.org/vuls/id/203719","title":"VU#203719 INFINITT PACS System Manager Contains Multiple Code Execution Vulnerabilities","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}