An unauthenticated attacker can exploit a flaw in the IModular.exe URI handler of INFINITT Healthcare Co., Ltd. INFINITT PACS to invoke unintended application functionality via a specially crafted imodular:// URI. The URI includes attacker‑controlled command and argument parameters that the application executes without proper validation, allowing arbitrary code execution on the host system.

The vulnerability affects the INFINITT Healthcare System Manager product, specifically the INFINITT PACS application. No specific version numbers are provided. Operators should verify that any instance of this product is running the latest patched release.

The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, so public exploitation data is limited. However, the CVSS score (not supplied) and the nature of the flaw point to a high exploitation risk. The likely attack vector is a remote, unauthenticated request to the improerentiated URI handler, which can be initiated over the network. If left unmitigated, an attacker could run arbitrary code, potentially leading to full system compromise.