CERT/CC Reports INFINITT PACS System Manager Code-Execution Flaws
Tech GuruQuick Answer
Identify System Manager 3.0.11.3 and 3.0.11.5 workstations and coordinate the appropriate update to 3.0.12.3 or 3.0.12.5. CERT/CC reports no indications of exploitation and provides no CVSS score.
Confirm Scope And Apply The Supported Remediation
What to do now: Record PACS workstations, System Manager branch, update privileges, URI-handler use and clinical owners. Match the documented versions, enabled features and attack prerequisites to the deployment before assigning applicability. Coordinate the vendor-supported fixed System Manager build with clinical IT and apply it as soon as operationally feasible. Verify installed components and test image retrieval, display, updates and approved integrations; retain deployment and clinical acceptance evidence.
Last verified: 2026-11-02 UTC. Recheck the authoritative advisory and supported distribution channel before changing production.
Scope And Authority
| Product scope | INFINITT PACS System Manager |
|---|---|
| Advisory | VU#203719 |
| CVEs | CVE-2026-16305, CVE-2026-16306 |
| Authoritative release date | 2026-11-02 15:38:19 UTC |
| Authority revision date | 2026-11-02 15:38:19 UTC |
| Affected versions | System Manager versions 3.0.11.3 and 3.0.11.5, as identified by CERT/CC. |
| Fixed version | System Manager 3.0.12.3 or 3.0.12.5, as appropriate to the supported installation |
| CVSS base score | Not provided by the authority |
| CVSS severity | Not provided by the authority |
| Exploitation status | CERT/CC states there are no indications that these vulnerabilities have been exploited.; no exploitation claim is inferred. |
Authority-Specific Scope And Version Evidence
| CVE-2026-16305 | Local modification of execlist.txt can cause elevated command execution when an update is approved. |
|---|---|
| CVE-2026-16306 | A crafted imodular:// link can trigger unsafe functions and an attacker-controlled outbound SignalR connection. |
What Changed
CERT/CC describes unsafe update-manifest permissions and unsafe command dispatch through imodular:// links, with fixes in two System Manager release branches.
What To Validate Now
- Inventory. Record PACS workstations, System Manager branch, update privileges, URI-handler use and clinical owners.
- Establish applicability. Match the documented versions, enabled features and attack prerequisites to the deployment before assigning applicability.
- Remediate. Coordinate the vendor-supported fixed System Manager build with clinical IT and apply it as soon as operationally feasible.
- Validate. Verify installed components and test image retrieval, display, updates and approved integrations; retain deployment and clinical acceptance evidence.
- Retain evidence. Preserve asset and owner identifiers, the applicability decision, before-and-after versions, change approval, installation output, validation results, and any exception or rollback record.
Operational Cautions
One flaw requires local file modification before an approved update; the other requires a user to open a crafted link. Preserve clinical availability and vendor-supported recovery procedures.
Evidence To Retain
- Exact product, release stream, package or application version, enabled feature, environment, and accountable owner.
- UTC timestamps, authority revision, approved change record, installer or package-manager output, and resulting version.
- Relevant logs and monitoring evidence, test results, exceptions, compensating controls, and rollback decisions.
Related TechGeeks Resources
Authoritative References
Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.
