INFINITT PACS Needs an Owner Inventory Beyond Its Application Fingerprint

Medical imaging platforms are often identified through browser titles, vendor portals and hospital-specific hostnames. ZoomEye can help with external discovery, but a single application string may miss the deployed PACS estate.

The count-only observations below used sub_type=all, page 1 and page size 1 on 2026-11-13 between 07:40 and 07:42 Asia/Shanghai.

The zero result is a finding about this query and scope. It is not evidence that no INFINITT PACS system is connected to the internet.

Why the title query matters

A PACS web portal may identify itself with a title such as INFINITT while the application fingerprint does not use the exact string tested. The 1,038 title matches form a candidate pool for ownership review. Each result still needs confirmation that it belongs to the organization and runs System Manager.

CERT/CC VU#203719 covers System Manager 3.0.11.3 and 3.0.11.5. One issue uses a weakly protected update manifest and local file permissions. The other exposes an imodular:// URI handler that can execute application functions from a crafted link.

The remote title search cannot see either local file permissions or the registered URI handler. It can find the organization's externally reachable imaging entry points, which is only the first step.

Build the owner list

Export the title-match candidate set with hostname, certificate, organization, country and update time when available. Match those values to hospital asset records and vendor support lists. Do not publish or message owners based on a product-name match alone.

Add the PACS hostnames from internal DNS, VPN logs, vendor inventories and clinical workstation management. Include systems that are not internet-visible, because the update-file and URI issues affect local workstations.

Triage sequence

Start with direct internet exposure of imaging portals. Restrict access where the clinical workflow permits. Then review System Manager versions on workstations and servers. Record the local groups that can write to execlist.txt and update directories.

Check whether imodular:// links are allowed by browsers, email clients and endpoint controls. Test the handler in a controlled environment and confirm that crafted links cannot run arbitrary application commands.

Remediation

Apply System Manager 3.0.12.3 or 3.0.12.5 as directed by the vendor. Verify the installed build on each host rather than relying on a central inventory that may be stale.

For exposed portals, add network authentication and limit access to clinical or administrative networks. Preserve clinical availability while changing firewall rules.

Evidence to keep

Store the exact dorks, timestamps, scope and counts with the investigation. Keep the list of confirmed INFINITT hosts separate from unverified matches. If a title is later reassigned or removed, the historical evidence still shows why the host entered the queue.

References

• CERT/CC VU#203719
• ZoomEye AI