INFINITT PACS Trusts Update Files and URI Handlers at the Workstation Boundary
Medical imaging workstations sit between clinical users, patient studies and the rest of the network. CERT/CC published VU#203719 on 2026-11-02 for two code execution issues in INFINITT PACS System Manager. Both rely on local trust decisions, but they fail in different places.
The affected System Manager versions are 3.0.11.3 and 3.0.11.5. INFINITT Healthcare lists fixed versions as 3.0.12.3 and 3.0.12.5.
Update approval is not the only control
CVE-2026-16305 concerns execlist.txt, a file read by SmartExecute.exe after an approved update. The advisory says its file permissions are insufficient. A low-privileged local attacker can modify the file before the update process consumes it and add commands to the execution list.
SmartUpdate.exe starts SmartExecute.exe later. User Account Control may prompt the user, and approval can allow the modified command to run with administrative privileges. The problem is not that the user approved an update. It is that the approved update process trusted a file another local user could change.
This creates a workstation compromise path. Local access may come from a shared clinical PC, a separate low-privilege foothold or a support session that leaves files accessible to the wrong principal. The impact is administrative execution on that workstation, including access to protected files, installed software and security settings.
URI handlers create a second entry point
CVE-2026-16306 is in IModular.exe and its handling of a registered imodular:// URI scheme. The application reads a cmd value from the link and executes a corresponding function without checking that the command is permitted or safe.
An attacker can send a crafted link that points to files or programs in a local folder or network share. The application can also accept a url parameter that makes it connect to an attacker-controlled SignalR endpoint. The victim must open the crafted link. Code then runs with the user's privileges and may send data to the remote endpoint.
The URI path does not need administrative rights. Its value comes from the ability to execute code as the clinical user and to use the workstation as a foothold. A fixed command allow list and checks for trusted input paths would address the core issue.
What to inventory
Start with the System Manager version on every PACS workstation, including shared devices and vendor-managed systems. Record whether each host has the imodular:// handler registered and which local groups can write to the installation and update directories.
Review the ACLs on execlist.txt, update directories and any user-writable shared folders. Check for unsigned or unexpected commands in the file, but treat an empty file as the beginning of the review rather than proof of integrity. A malicious command may already have run.
Apply System Manager 3.0.12.3 or 3.0.12.5 as appropriate. Until that update is installed, restrict local logon and shared workstation use, limit network shares reachable from PACS systems and block crafted URI links through email and browser controls where possible.
Clinical continuity
Do not isolate a PACS workstation without accounting for image review and clinical workflow. Coordinate maintenance windows with the imaging team, preserve the ability to retrieve prior studies and verify the upgrade from the workstation itself after deployment.
The advisory says there is no indication of exploitation. That status does not remove the need to inspect exposed workstations. It means defenders should report only what they can prove from the affected hosts and application versions.
