CVE-2026-16305 in System Manager
Summary
by MITRE • 11/02/2026
Local privilege escalation in `SmartUpdate.exe` and `SmartExecute.exe` in INFINITT Healthcare Co., Ltd. INFINITT PACS allows a local low-privileged attacker to execute arbitrary commands with administrator privileges via modification of a world-writable `execlist.txt` command manifest that is processed during application updates.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 11/02/2026
The vulnerability identified within the INFINITT PACS software suite, specifically affecting SmartUpdate.exe and SmartExecute.exe components, represents a critical local privilege escalation flaw rooted in improper file permission management. This security defect allows an attacker with low-privileged access on the affected system to escalate their rights to those of an administrator or SYSTEM user. The core technical issue lies in the handling of the execlist.txt command manifest file, which serves as a configuration input for the update mechanisms embedded within these executables. During the execution of updates, both SmartUpdate.exe and SmartExecute.exe read this specific text file to determine what actions should be performed. However, the operating system permissions assigned to this critical configuration file are configured incorrectly, granting write access to all users on the local machine rather than restricting it exclusively to privileged accounts or the application itself.
From a technical perspective, this flaw constitutes an insecure default permission setting that leads to unauthorized modification of executable behavior. Because the execlist.txt file is world-writable, any user account logged into the system can alter its contents without authentication or authorization checks from the operating system. When SmartUpdate.exe or SmartExecute.exe subsequently runs and parses this manifest, it blindly executes the commands listed within, assuming they originate from a trusted source due to their presence in the designated configuration directory. This lack of integrity verification means that an attacker can inject arbitrary command-line arguments into the file, effectively tricking the privileged application into executing malicious code with elevated privileges. The attack vector is local and requires low-privileged access, making it particularly dangerous in multi-user environments or shared workstations where lateral movement from a standard user account to an administrative one provides significant control over the host system.
The operational impact of this vulnerability is severe, as successful exploitation grants the attacker full administrative control over the PACS server or workstation. In healthcare IT environments, such systems often contain sensitive patient data and are connected to critical medical imaging devices. An adversary gaining administrator privileges can bypass security controls, install persistent backdoors, exfiltrate protected health information in violation of regulations like HIPAA, or disrupt clinical operations by modifying system configurations. Furthermore, because the vulnerability exists within update utilities, it may also facilitate persistence if the attacker modifies future update scripts to execute malicious payloads automatically during subsequent maintenance windows. This scenario aligns with common attack patterns where adversaries leverage weak file permissions to escalate privileges and establish a foothold for further lateral movement across the network infrastructure.
This issue is best categorized under CWE-732, which describes incorrect permission assignment for critical resources, as well as CWE-434, involving the unrestricted upload of files or execution of arbitrary code through insecure configuration mechanisms. In terms of adversary tactics, this vulnerability supports techniques associated with MITRE ATT&CK T1068, specifically exploitation for privilege escalation, and potentially T1574, which covers hijacking of executable files if the attacker modifies the executables themselves to persistently exploit the permission flaw. To mitigate this risk, immediate remediation should focus on correcting the file system permissions for execlist.txt so that only administrators or specific service accounts have write access. Additionally, implementing integrity checks such as digital signatures or checksums within SmartUpdate.exe and SmartExecute.exe would prevent the execution of modified manifests even if an attacker manages to alter the file content temporarily. Regular auditing of configuration files in application directories is also recommended to ensure no other world-writable artifacts exist that could be leveraged for similar attacks.