Weak Password Protection Enables Medical Image Link Brute Force

CVE-2026-19877 affects INFINITT ULite 5.0.2.1 and earlier, a medical imaging platform used by healthcare organizations worldwide. The vulnerability stems from two critical weaknesses: image-share links are protected by low-entropy passwords, and the application fails to implement rate limiting or account lockout mechanisms on password attempts. This allows unauthenticated attackers to systematically guess passwords and gain unauthorized access to shared medical images within the link validity window. For healthcare organizations, this represents a direct threat to patient privacy, HIPAA compliance, and data integrity—attackers could access, exfiltrate, or potentially modify sensitive diagnostic images without detection.

Casky's security skills powered by Claude AI with extended reasoning would detect attack patterns associated with this vulnerability through behavioral analysis of authentication attempts, even though MITRE ATT&CK mappings aren't formally assigned. Practitioners using Casky would identify suspicious patterns including rapid sequential password submission attempts (credential stuffing indicators), failed authentication requests from single sources, and timing patterns consistent with brute-force attacks against image-share endpoints. The platform's Claude-driven analysis would correlate these findings with weak cryptographic implementation signals—such as predictable link structures or abnormally short password complexity requirements visible in traffic analysis—to flag credential access attempts (ATT&CK T1110: Brute Force) and unauthorized information discovery (T1526: Gather Victim Identity Information). Security teams would see alerts highlighting the absence of rate-limiting controls and recommendations to implement exponential backoff, multi-factor verification, or time-locked access mechanisms before updating to patched version BN50.