CVE-2026-19877: Brute-forceable image-share link password in INFINITT ULite

Published Nov 6, 2026

Updated

INFINITT ULite 5.0.2.1BN4820260528 and earlier protects image-share links with a low-entropy password and does not restrict repeated password attempts, allowing an unauthenticated remote attacker to brute-force the password within the link validity window and gain unauthorized access to shared medical images. Fixed in ULite 5.0.2.1 BN50.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade INFINITT ULite to a version that resolves this vulnerability.
Fixed in 5.0.2.1 BN50
Compensating control
Generate image-share link passwords with at least 128 bits of entropy.
Compensating control
Rate-limit or lock out repeated image-share password attempts, counting failures against the per-link quota.

Event History

Nov 6, 2026

CVE Published

via MITRE·08:30 AM

Data Sourced

via MITRE·08:30 AM

RemedyDescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

An unauthenticated remote attacker can exploit it if they can access an image-share link and attempt passwords during that link's validity window.

Are deployments affected by default?

The provided information states that image-share links are protected by a low-entropy password and do not restrict repeated attempts in affected versions. It does not identify a configuration setting that disables or mitigates this behavior.

What versions contain the fix?

The issue is fixed in INFINITT ULite 5.0.2.1 BN50. Versions 5.0.2.1_BN48_20260528 and earlier are affected.

What can be done if updating is not immediately possible?

The provided information does not specify a workaround. Because exploitation depends on repeated password attempts within the link validity window, limiting exposure of image-share links and minimizing their validity windows may reduce opportunity, but these measures are not documented as a complete mitigation.

CVE-2026-19877: Brute-forceable image-share link password in INFINITT ULite

Remediation

Event History

Frequently Asked Questions

Who can exploit this issue?

Are deployments affected by default?

What versions contain the fix?

What can be done if updating is not immediately possible?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

Are deployments affected by default?

What versions contain the fix?

What can be done if updating is not immediately possible?