CVE-2026-19877
Brute-forceable image-share link password in INFINITT ULite
CVSS Score
7.5
EPSS Score
0.0%
EPSS Percentile
0th
INFINITT ULite 5.0.2.1_BN48_20260528 and earlier protects image-share links with a low-entropy password and does not restrict repeated password attempts, allowing an unauthenticated remote attacker to brute-force the password within the link validity window and gain unauthorized access to shared medical images. Fixed in ULite 5.0.2.1 BN50.
| CWE | CWE-307 CWE-331 |
| Vendor | infinitt healthcare |
| Product | infinitt ulite |
| Published | Nov 6, 2026 |
Stay Ahead of the Next One
Get instant alerts for infinitt healthcare infinitt ulite
Be the first to know when new high vulnerabilities affecting infinitt healthcare infinitt ulite are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None
Affected Versions
INFINITT Healthcare / INFINITT ULite
0 ≤ 5.0.2.1_BN48_20260528
References
Credits
SecureMind - Loic Salaris