{"affected":[{"defaultStatus":"unknown","product":"INFINITT ULite","source":"CNA: NCSC.ch","vendor":"INFINITT Healthcare","versions":[{"lessThanOrEqual":"5.0.2.1_BN48_20260528","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"5.0.2.1_BN50","versionType":"custom"}]}],"cveId":"CVE-2026-19877","cwes":["CWE-307","CWE-331"],"description":"INFINITT ULite 5.0.2.1_BN48_20260528 and earlier protects image-share links with a low-entropy password and does not restrict repeated password attempts, allowing an unauthenticated remote attacker to brute-force the password within the link validity window and gain unauthorized access to shared medical images. Fixed in ULite 5.0.2.1 BN50.","epss":null,"exploits":[],"kev":null,"metrics":[{"score":7.5,"severity":"high","source":"CNA: NCSC.ch","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"}],"modifiedAt":1793953814583,"publishedAt":1793953814583,"references":[{"source":"CNA: NCSC.ch","tags":[],"url":"https://www.infinitt.com/contents/content.php?url=INFINITT-SA-2026-001"}],"remediation":[{"kind":"fix","source":"CNA: NCSC.ch","text":"Upgrade to INFINITT ULite 5.0.2.1 BN50 or later. Generate share passwords with at least 128 bits of entropy, and rate-limit / lock out repeated attempts (count failures against the per-link quota)."}],"revision":"dbcf64895c0cb71507ed08229aa6d7a590dea6f40b19d35b6904ecc455e84d31","sources":[{"modifiedAt":1793953814583,"name":"CNA: NCSC.ch","retrievedAt":1793956134705,"url":"https://www.cve.org/CVERecord?id=CVE-2026-19877"}],"ssvc":null,"status":"published","title":"Brute-forceable image-share link password in INFINITT ULite","updatedAt":1793956134705}