Immediate Patching Required to Address High Severity INFINITT PACS Vulnerability
Three vulnerabilities have been identified in the INFINITT Healthcare INFINITT PACS, including a high-severity vulnerability for which there are publicly available exploits. CISA warns that the vulnerabilities can be exploited in a low-complexity attack.
The high-severity vulnerability is tracked as CVE-2025-27721. Successful exploitation would allow an unauthorized user to access the system without proper authorization and access system resources. The vulnerability has been assigned a CVSS v4 severity score of 8.7 out of a maximum of 10 (CVSS v3.1 base score: 7.5).
The two other vulnerabilities are rated as medium severity with CVSS v4 base scores of 5.3 (CVSS v3.1 base score 6.3) and are due to a lack of controls preventing dangerous file uploads. The first vulnerability is tracked as CVE-2025-27714 and can be exploited by a malicious actor by uploading arbitrary files via a specific endpoint. The other vulnerability is tracked as CVE-2025-24489 and can be exploited by an attacker by uploading arbitrary files via a specific service, potentially leading to system compromise. The vulnerabilities were identified by security researcher Piotr Kijewski of the Shadowserver Foundation, who reported them to the U.S. Cybersecurity and Infrastructure Security Agency (CISA).
The three vulnerabilities have been fixed in the latest version of the software: 3.0.11.5 BN10 and later versions. Users should ensure they update their software to the latest version as soon as possible to prevent exploitation. INFINITT Healthcare said INFINITT ULite is unaffected, although if it is operating as an integrated system within INFINITT PACS, then patching is required to secure the PACS environment.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
In addition to applying the patches, INFINITT Healthcare recommends enforcing strong password policies, enabling logging to monitor for unauthorized access attempts, and configuring the System Manager settings to restrict unauthorized file uploads. Further, users should ensure that their PACS servers are not directly accessible from the Internet.
