A critical authorization bypass vulnerability in INFINITT PACS System Manager enables unauthenticated remote access to sensitive system resources.

The vulnerability stems from an authorization failure (CWE-497) that permits unauthenticated attackers to gain unauthorized access to the System Manager interface, potentially exposing sensitive medical imaging data and system configurations.

The ability for unauthenticated users to access the PACS System Manager poses a severe risk to healthcare operations and patient data confidentiality. Given the CVSS score of 7.5, this vulnerability represents a high-risk entry point that could lead to unauthorized data exfiltration, service disruption, or further exploitation of the medical imaging environment.

Immediate Action: Update the INFINITT PACS System Manager software to version 3.0.11.5 BN10 or later to apply the necessary security patches.

Proactive Monitoring: Review system access logs for suspicious login attempts or unauthorized sessions originating from unknown or external IP addresses.

Compensating Controls: Ensure the PACS environment is segmented from the public internet and protected by a robust firewall, as well as strict network access control lists, to limit exposure of the management interface.

Public Exploit Available: No

Due to the sensitive nature of medical imaging systems and the potential for unauthorized access to patient data, organizations must prioritize the application of the vendor-supplied patch. Administrators should verify their current version and upgrade to 3.0.11.5 BN10 immediately to eliminate this exposure.