CVE-2026-19877 Details
Description
INFINITT ULite 5.0.2.1_BN48_20260528 and earlier protects image-share links with a low-entropy password and does not restrict repeated password attempts, allowing an unauthenticated remote attacker to brute-force the password within the link validity window and gain unauthorized access to shared medical images. Fixed in ULite 5.0.2.1 BN50.
A vulnerability exists in INFINITT ULite versions through 5.0.2.1_BN48_20260528, where image-share links are protected by a low-entropy password. The application does not limit repeated password attempts, enabling an unauthenticated remote attacker to brute-force the password within the link's validity period. This flaw could lead to unauthorized access to shared medical images.
Users can upgrade to INFINITT ULite version 5.0.2.1 BN50 to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Nov 6, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://www.infinitt.com/contents/content.php?url=INFINITT-SA-2026-001 | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-307 | Improper Restriction of Excessive Authentication Attempts | [email protected] |
| CWE-331 | Insufficient Entropy | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| INFINITT ULite | <= 5.0.2.1_BN48_20260528 |
CPE
Remediation
| |
Change History
1 change record found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 6, 2026 | New CVE Received | [email protected] |