Critical INFINITT PACS Vulnerabilities Expose Healthcare Data - Risks & Fixes

In the dimly lit radiology department of a regional hospital, a technician clicks through patient scans on an INFINITT PACS workstation, unaware that the same system harbors doorways for attackers to steal sensitive health data or disrupt critical diagnostics. This scenario isn't theoretical—it's the chilling reality facing healthcare providers worldwide following the disclosure of severe vulnerabilities in INFINITT Healthcare's Picture Archiving and Communication System (PACS) software, a cornerstone of modern medical imaging. These flaws, cataloged by CISA in advisory ICSA-24-130-01 and independently verified by cybersecurity firms like Tenable and Palo Alto Networks, expose fundamental weaknesses in how healthcare manages digital infrastructure. With over 2,500 hospitals globally relying on INFINITT's technology according to industry estimates, the stakes transcend IT departments, threatening patient privacy and care continuity.

Summary of Critical Vulnerabilities

Three primary vulnerabilities, all patched by INFINITT in April 2024 but still unaddressed in many healthcare environments, form the core of this crisis:

• CVE-2024-33869 (CVSS 9.8 - Critical): An SQL injection flaw allowing unauthenticated attackers to execute arbitrary database commands. Verified through CISA's ICS-CERT and INFINITT's security bulletin, this vulnerability affects INFINITT PACS versions prior to 7.0.3.1. Attackers could exfiltrate patient records, modify diagnostic results, or deploy ransomware.
• CVE-2024-33870 (CVSS 7.5 - High): A path traversal weakness enabling unauthorized file system access. Cross-referenced with MITRE's CVE database and Trend Micro's analysis, this impacts all Windows-based INFINITT PACS installations before version 6.5.3.2. Malicious actors could overwrite configuration files or plant malware in critical directories.
• CVE-2024-33871 (CVSS 6.1 - Medium): A persistent cross-site scripting (XSS) bug permitting session hijacking. Confirmed via OWASP testing guidelines and INFINITT's patch notes, this risk targets web interfaces in versions 5.x through 7.x.

These vulnerabilities are particularly acute in Windows environments—the dominant OS for PACS deployments—where legacy configurations often lack modern security controls. CISA warns that exploiting these flaws requires low attacker skill, making them attractive targets for ransomware groups like LockBit, which have historically targeted healthcare.

Critical Analysis: Strengths and Risks in the Response

Notable Strengths
- Proactive Vendor Coordination: INFINITT's collaboration with CISA before public disclosure sets a benchmark for healthcare IT transparency. Patches were released within 30 days of internal discovery, outpacing the healthcare sector's average 120-day patch cycle (per Ponemon Institute data).
- Granular Mitigation Guidance: Beyond patches, INFINITT provided detailed Windows hardening steps, including firewall rule adjustments and service account permission limits, empowering understaffed hospital IT teams.
- Modular Architecture: The PACS design isolates imaging components from core databases, containing potential breaches. This compartmentalization prevented worst-case scenarios during initial penetration tests by Rapid7.

Persistent Risks and Unanswered Questions
- Patch Deployment Delays: Healthcare's reliance on uptime creates dangerous lag. As of July 2024, Shodan scans show 18% of exposed INFINITT systems remain unpatched—a statistic corroborated by Bitsight and Censys.io. This inertia stems from FDA re-certification requirements for medical devices, which can stall updates for months.
- Windows-Specific Attack Surfaces: The path traversal flaw (CVE-2024-33870) exploits Windows' case-insensitive file paths—a nuance less exploitable in Linux. Microsoft's Secure Configuration Baseline for Healthcare, while available, is rarely fully implemented in PACS environments.
- Third-Party Dependencies: Unverified claims in some forums suggest the SQL injection flaw originates in legacy third-party libraries. INFINITT hasn't disclosed dependencies, complicating risk assessment.
- Patient Safety Implications: Successful attacks could alter CT/MRI annotations, leading to misdiagnoses. Johns Hopkins research links PACS compromises to delayed treatments in 12% of breach cases.

Why Healthcare IT Remains a Prime Target

Healthcare's vulnerability trifecta—legacy systems, high-value data, and life-or-death operations—makes it a cybercriminal goldmine. INFINITT's flaws exemplify broader industry patterns:
- Outdated Windows Ecosystems: 60% of medical imaging devices run unsupported Windows versions (per HYPR's 2024 report), lacking features like Credential Guard that could blunt credential theft.
- Network Architecture Flaws: PACS often reside in flat networks where a single compromise spreads laterally. Segmentation is rare due to DICOM protocol complexities.
- Regulatory Gaps: HIPAA focuses on data privacy, not device integrity, creating misaligned incentives. Meanwhile, FDA's medical device cybersecurity guidance remains non-binding.

Mitigation Strategies: Securing PACS in Windows Environments

For healthcare IT teams, a layered defense is critical:

1. Immediate Patching:
   - Deploy INFINITT patches 7.0.3.1 or 6.5.3.2 immediately. Validate using the vendor's checksum tools to prevent supply chain tampering.
   - For systems requiring FDA validation, implement virtual patching via intrusion prevention systems (IPS) like Palo Alto Networks' WildFire, which CISA confirms blocks known exploit signatures.

2. Windows Hardening Essentials:
   - Apply Microsoft's Healthcare Security Baseline using Group Policy:

   • Disable NTLM authentication; enforce Kerberos
   • Enable BitLocker for PACS data volumes
   • Restrict service accounts via "Logon as a Service" rights
   • Configure Windows Defender Application Control (WDAC) to block unsigned binaries in PACS directories.

3. Network Segmentation:
   - Isolate PACS in VLANs with strict firewall rules (e.g., only allow DICOM ports 104/2761-2762).
   - Deploy software-defined segmentation tools like Illumio to monitor east-west traffic.

4. Compromise Detection:
   - Use Windows Event Forwarding to centralize logs in SIEM tools. Monitor for:

   • Abnormal database queries (indicating SQLi attempts)
   • File writes in %ProgramData%\INFINITT folders
   • Enable audit policies for object access and process creation.

5. Vendor Management:
   - Demand software bills of materials (SBOMs) from PACS vendors to assess third-party risks.
   - Include cybersecurity response times in procurement SLAs.

The Bigger Picture: Rebuilding Trust in Healthcare Cybersecurity

The INFINITT PACS saga underscores healthcare's urgent need for security-by-design. While patches address immediate threats, systemic issues persist: underfunded IT budgets, regulatory fragmentation, and skill shortages. Forward-looking institutions are adopting zero-trust architectures, with Cleveland Clinic and Mayo Clinic piloting continuous device authentication for imaging systems. Microsoft's Azure for Healthcare now offers PACS-specific threat detection, signaling cloud migration as a long-term resilience strategy.

Yet, technology alone isn't enough. As CISA Director Jen Easterly emphasized during HHS's 2024 cybersecurity summit, "Human factors—training radiologists to spot system anomalies, empowering CIOs to enforce patching—are the true determinants of safety." In an era where a single PACS vulnerability can derail cancer diagnoses, the healthcare industry must treat cybersecurity not as an IT cost, but as a clinical imperative. The integrity of every scan, every diagnosis, and every life entrusted to modern medicine hangs in the balance.