INFINITT ULite image-share link password can be brute-forced
Anyone can guess share-link passwords in this medical imaging program and view the images.
Summary
INFINITT ULite protects image-share links with a low-entropy password and does not limit repeated password attempts. An unauthenticated remote attacker can guess the password within the link validity window and access shared medical images.
Affected when
- Image-share link feature in use
What to do
Update to ULite 5.0.2.1 BN50 or later.
Products and platforms
CVE IDs
Sources
- CVE record: cve.org (opens in a new tab)
- KISA notice: KISA 보호나라: 인피니트헬스케어 제품 보안 업데이트 권고 (opens in a new tab)
Times
First published
First seen