LIVE FEED

CISA: every Flow Neuroscience FL-100 tDCS headset shares one hardcoded BLE credential, CVE-2026-18164 rated 8.1 Coalition for Health AI convenes 100 member cyber work group, AI attack and defense playbooks due by year end CRA Article 14 reporting obligations take effect September 11 EU MDR revision proposal adds a 30 day exploited-vulnerability reporting clock via Eudamed Mira hormone monitor cloud API handed session tokens to any password, CVE-2026-68067 rated 9.8 Pulsetto vagus nerve stimulator ships hidden BLE commands: no patch, no vendor response CISA: every Flow Neuroscience FL-100 tDCS headset shares one hardcoded BLE credential, CVE-2026-18164 rated 8.1 Coalition for Health AI convenes 100 member cyber work group, AI attack and defense playbooks due by year end CRA Article 14 reporting obligations take effect September 11 EU MDR revision proposal adds a 30 day exploited-vulnerability reporting clock via Eudamed Mira hormone monitor cloud API handed session tokens to any password, CVE-2026-68067 rated 9.8 Pulsetto vagus nerve stimulator ships hidden BLE commands: no patch, no vendor response

Vulnerability

Unrestricted file upload on a PACS points straight at code execution

MedDevice Cyber Staff · Apr 10 · 2 min read · Via CISA

INFINITT PACS System Manager, versions 3.0.11.5 BN9 and prior, got ICSMA-25-100-01. Two unrestricted file-upload flaws, CVE-2025-27714 and CVE-2025-24489, plus an information-exposure bug, CVE-2025-27721 at 7.5. Piotr Kijewski of the Shadowserver Foundation reported them.

Unrestricted upload is a direct line to code execution. Put an executable where the server will run it and the imaging archive is yours, and the info-exposure bug hands you reconnaissance to go with the foothold. A PACS holds every image, every study, every identifier a radiology department has.

Validate what gets uploaded, type and extension and content, and never store an upload where the web server will execute it. This bug class is old and it still owns servers.

Remediation Desk

INFINITT PACS System Manager had two unrestricted file-upload flaws pointing at remote code execution plus an information-exposure bug, on the server that holds the imaging archive (ICSMA-25-100-01). Apply the fix and constrain uploads by type, location and execution.

Apply the vendor fix. Update INFINITT PACS System Manager to the remediated version from ICSMA-25-100-01.
Constrain uploads. Validate file type and content, store uploads outside the web root, and never let an uploaded file execute.
Segment the archive server. Keep the PACS server off any segment that does not need it, since it holds the imaging archive.

Sources

CISA ↗

Questions & Answers

What was found in INFINITT PACS System Manager?

ICSMA-25-100-01 covers versions 3.0.11.5 BN9 and prior: two unrestricted file-upload flaws, CVE-2025-27714 and CVE-2025-24489, plus an information-exposure bug, CVE-2025-27721 at 7.5. Piotr Kijewski of the Shadowserver Foundation reported them.

What does unrestricted file upload mean for a PACS?

An attacker who can place an executable where the server will run it takes the imaging archive, which holds every image, study and identifier a radiology department has. Uploads need type, extension and content validation, stored where the web server cannot execute them.

← Back to Vulnerabilities