{"id":"CVE-2026-19877","kind":"vulnerability","aliases":["CVE-2026-19877"],"related":[],"title":"INFINITT ULite: image-share links brute-forceable, exposing shared medical images","description":"INFINITT ULite 5.0.2.1_BN48_20260528 and earlier protects image-share links with a low-entropy password and does not restrict repeated password attempts, allowing an unauthenticated remote attacker to brute-force the password within the link validity window and gain unauthorized access to shared medical images. Fixed in ULite 5.0.2.1 BN50.","summary":"INFINITT ULite protects image-share links with a low-entropy password and does not limit repeated password attempts. An unauthenticated remote attacker can brute-force the password within the link's validity window and view the shared medical images.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["healthcare","infinitt","medical-imaging","other","ulite"],"not_affected_if":["fixed-version","no-image-share-links"],"how_to_check":"- Confirm whether the ULite version is `5.0.2.1_BN48_20260528` or earlier\n- Check whether image-share links are in use in your ULite deployment\n- Other checks: unknown","fix":"- INFINITT ULite: move to `5.0.2.1 BN50` or later","status":"open","published_at":"2026-11-06T09:17:01+00:00","first_seen_at":"2026-11-06T09:40:32+00:00","triaged_at":"2026-11-06T09:40:42+00:00","updated_at":"2026-11-06T09:40:42+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-11-06T09:40:42Z","model":"claude-haiku-5-5","output":{"fix":"- INFINITT ULite: move to `5.0.2.1 BN50` or later","reach":"internet","title":"INFINITT ULite: image-share links brute-forceable, exposing shared medical images","impact":"high","summary":"INFINITT ULite protects image-share links with a low-entropy password and does not limit repeated password attempts. An unauthenticated remote attacker can brute-force the password within the link's validity window and view the shared medical images.","audience":"businesses","category":"other","nicknames":[],"who_cares":["infinitt","ulite","medical-imaging","healthcare"],"confidence":0.6,"fix_status":"available","needs_auth":"no","worst_case":"Attacker reads shared medical images after guessing the link password","analyst_note":"Confirm the default share-link configuration and whether the attack is reachable from the internet; the NVD entry is the only source.","how_to_check":"- Confirm whether the ULite version is `5.0.2.1_BN48_20260528` or earlier\n- Check whether image-share links are in use in your ULite deployment\n- Other checks: unknown","plain_action":"","needs_analyst":true,"not_affected_if":["no-image-share-links","fixed-version"],"who_is_affected":"Hospitals and clinics that run INFINITT ULite and share medical images through share links are exposed. Installations that do not use image-share links, or that run a version later than `5.0.2.1_BN48_20260528`, are not affected by this description. The sources do not say whether the flaw is reachable from the internet by default.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000706,"input_tokens":4256,"output_tokens":561,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-19877':16A,19A '-2026':15A,18A '20260528':73C '5.0.2.1':71C,121C 'access':113C 'allow':94C 'attack':50B,98C 'attempt':46B,93C 'bn48':72C 'bn50':122C 'brute':8A,53B,101C 'brute-forc':7A,52B,100C 'cve':14A,17A 'earlier':75C 'entropi':38B,85C 'expos':10A 'fix':118C 'forc':54B,102C 'forceabl':9A 'gain':111C 'healthcar':20B 'imag':4A,13A,24B,31B,68B,78C,117C 'image-shar':3A,30B,77C 'infinitt':1A,21B,27B,69C 'limit':43B 'link':6A,33B,59B,80C,107C 'low':37B,84C 'low-entropi':36B,83C 'medic':12A,23B,67B,116C 'medical-imag':22B 'password':39B,45B,56B,86C,92C,104C 'protect':29B,76C 'remot':49B,97C 'repeat':44B,91C 'restrict':90C 'share':5A,11A,32B,66B,79C,115C 'ulit':2A,26B,28B,70C,120C 'unauthent':48B,96C 'unauthor':112C 'valid':61B,108C 'view':64B 'window':62B,109C 'within':57B,105C","nicknames":[],"mitigations":[],"who_affected":"Hospitals and clinics that run INFINITT ULite and share medical images through share links are exposed. Installations that do not use image-share links, or that run a version later than `5.0.2.1_BN48_20260528`, are not affected by this description. The sources do not say whether the flaw is reachable from the internet by default.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["healthcare","high","infinitt","medicalimaging","other","ulite"],"campaign_type":null,"search_a":"'-19877':16A,19A '-2026':15A,18A 'brute':8A 'brute-forc':7A 'cve':14A,17A 'expos':10A 'forceabl':9A 'imag':4A,13A 'image-shar':3A 'infinitt':1A 'link':6A 'medic':12A 'share':5A,11A 'ulit':2A","search_b":"'attack':50B 'attempt':46B 'brute':53B 'brute-forc':52B 'entropi':38B 'forc':54B 'healthcar':20B 'imag':24B,31B,68B 'image-shar':30B 'infinitt':21B,27B 'limit':43B 'link':33B,59B 'low':37B 'low-entropi':36B 'medic':23B,67B 'medical-imag':22B 'password':39B,45B,56B 'protect':29B 'remot':49B 'repeat':44B 'share':32B,66B 'ulit':26B,28B 'unauthent':48B 'valid':61B 'view':64B 'window':62B 'within':57B","search_c":"'20260528':73C '5.0.2.1':71C,121C 'access':113C 'allow':94C 'attack':98C 'attempt':93C 'bn48':72C 'bn50':122C 'brute':101C 'brute-forc':100C 'earlier':75C 'entropi':85C 'fix':118C 'forc':102C 'gain':111C 'imag':78C,117C 'image-shar':77C 'infinitt':69C 'link':80C,107C 'low':84C 'low-entropi':83C 'medic':116C 'password':86C,92C,104C 'protect':76C 'remot':97C 'repeat':91C 'restrict':90C 'share':79C,115C 'ulit':70C,120C 'unauthent':96C 'unauthor':112C 'valid':108C 'window':109C 'within':105C","first_public_at":"2026-11-06T09:17:01+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cvss_by":"vulnerability@ncsc.ch","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-19877","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-19877","severity":null,"published_at":"2026-11-06T09:17:01+00:00","modified_at":"2026-11-06T09:17:01+00:00","first_seen_at":"2026-11-06T09:40:32+00:00","fetched_at":"2026-11-06T09:40:32+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}