The vulnerability lies in the use of a low‑entropy password for image‑share links in INFINITT ULite, coupled with the absence of any access restriction for repeated attempts. An attacker who obtains a share link can thus try passwords until the correct one is found, allowing the attacker to view protected medical images without authentication. The short validity window of the link does not mitigate the risk, as brute‑forcing can still occur within that period.

INFINITT Healthcare’s INFINITT ULite product, specifically versions 5.0.2.1_BN48_20260528 and earlier. The issue does not affect later releases that implement the recommended fixes.

The CVSS score of 7.5 indicates high severity, and while an EPSS score is not provided, the CVE is not listed in the CISA KEV catalog, suggesting no known widespread exploitation at this time. The vulnerability can be exploited remotely by an unauthenticated attacker using a shared link. An attacker does not need any special privileges beyond the link, and no additional pre‑conditions are described in the advisory. The risk is therefore moderate to high, with potential for significant confidentiality breaches of sensitive medical images.