{"id":"CVE-2026-19877","title":"Brute-forceable image-share link password in INFINITT ULite","summary":"INFINITT ULite 5.0.2.1_BN48_20260528 and earlier protects image-share links with a low-entropy password and does not restrict repeated password attempts, allowing an unauthenticated remote attacker to brute-force the password within the …","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cvssSource":"cna","cwe":["CWE-307","CWE-331"],"vendor":"INFINITT Healthcare","product":"INFINITT ULite","affected":["infinitt_ulite <= 5.0.2.1_BN48_20260528"],"published":"2026-11-06","updated":"2026-11-06","sourceUpdated":"2026-11-06T08:30:14.583Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-19877","references":[{"url":"https://www.infinitt.com/contents/content.php?url=INFINITT-SA-2026-001","label":"INFINITT ULite security advisory INFINITT-SA-2026-001 (BN50)"}],"tags":["cve.org"],"ingestedAt":"2026-11-06T08:48:01.706Z","slug":"CVE-2026-19877","body":"## Overview\n\nINFINITT ULite 5.0.2.1_BN48_20260528 and earlier protects image-share links with a low-entropy password and does not restrict repeated password attempts, allowing an unauthenticated remote attacker to brute-force the password within the link validity window and gain unauthorized access to shared medical images. Fixed in ULite 5.0.2.1 BN50.\n\n## Affected\n\n- `infinitt_ulite <= 5.0.2.1_BN48_20260528`\n\n## Remediation\n\nUpgrade to INFINITT ULite 5.0.2.1 BN50 or later. Generate share passwords with at least 128 bits of entropy, and rate-limit / lock out repeated attempts (count failures against the per-link quota).","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}