VU#203719 INFINITT PACS System Manager flaws allow code execution

Installations of INFINITT PACS, an enterprise web-based medical imaging platform for storing, retrieving, and displaying patient scans, using System Manager versions 3.0.11.3 and 3.0.11.5 contain two vulnerabilities that may allow an attacker to execute arbitrary code.

CVE-2026-16305 involves an improperly protected update manifest that may allow a local attacker to execute commands with administrative privileges when an update is approved. SmartExecute.exe reads and runs commands from execlist.txt after an update, and insecure file permissions on that file let a low-privileged attacker add malicious commands before processing. After SmartUpdate.exe launches SmartExecute.exe, User Account Control (UAC) may prompt the user, which can allow the malicious command to run with administrative privileges.

CVE-2026-16306 concerns unsafe command dispatch through the imodular:// URI scheme. IModular.exe reads the cmd value from a crafted imodular:// link and runs the matching function without verifying that the command is permitted or safe. When an end user is convinced to open such a link, IModular.exe can access attacker-controlled files or run specific programs from a local folder or network share. A url parameter in the link causes IModular.exe to connect to an attacker-controlled SignalR endpoint, creating an unauthorized outbound connection.

Successful exploitation of CVE-2026-16305 may let a local, low-privileged attacker run arbitrary commands with administrative privileges on the affected workstation, enabling installation or modification of software, access to protected files, disabling of security controls, or persistent access to the system. Successful exploitation of CVE-2026-16306 may let a remote attacker execute code with the affected user's privileges, access or modify that user's data, use the workstation as a foothold for further attacks, and establish unauthorized outbound communication with an attacker-controlled SignalR server.

No indications exist that these vulnerabilities have been exploited. INFINITT Healthcare recommends upgrading affected installations to System Manager 3.0.12.3 or System Manager 3.0.12.5.

Organizations are advised to apply the appropriate update as soon as operationally feasible. Piotr Berlinski of CyberArms.io is credited with identifying the vulnerabilities, and INFINITT is thanked for addressing them quickly. Michael Bragg wrote the document, which was published and last updated on 2026-11-02 at 15:38 UTC as Document Revision 1.