Description
INFINITT ULite 5.0.2.1_BN48_20260528 and earlier protects image-share links with a low-entropy password and does not restrict repeated password attempts, allowing an unauthenticated remote attacker to brute-force the password within the link validity window and gain unauthorized access to shared medical images. Fixed in ULite 5.0.2.1 BN50.
Published: 2026-11-06
Score: 7.5 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Remediation

Vendor Solution

Upgrade to INFINITT ULite 5.0.2.1 BN50 or later. Generate share passwords with at least 128 bits of entropy, and rate-limit / lock out repeated attempts (count failures against the per-link quota).

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 06 Nov 2026 08:45:00 +0000

Type Values Removed Values Added
Description INFINITT ULite 5.0.2.1_BN48_20260528 and earlier protects image-share links with a low-entropy password and does not restrict repeated password attempts, allowing an unauthenticated remote attacker to brute-force the password within the link validity window and gain unauthorized access to shared medical images. Fixed in ULite 5.0.2.1 BN50.
Title Brute-forceable image-share link password in INFINITT ULite
Weaknesses CWE-307
CWE-331
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: NCSC.ch

Published:

Updated: 2026-11-06T08:30:14.583Z

Reserved: 2026-08-14T14:11:08.980Z

Link: CVE-2026-19877

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-11-06T09:17:01.700

Modified: 2026-11-06T09:17:01.700

Link: CVE-2026-19877

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-11-06T09:30:08Z

Weaknesses
  • CWE-307

    Improper Restriction of Excessive Authentication Attempts

  • CWE-331

    Insufficient Entropy