CVE-2026-58126
CriticalCVSS 9.8Exploitation Probability (EPSS)
Elevated risk57th percentile - higher than 57% of all known CVEs
Summary
PACSgear PACS Scan 5.2.1 contains an unauthenticated remote code execution vulnerability, allowing attackers to read and write arbitrary files by exploiting an exposed .NET Remoting TCP service on port 22222 via PGImageExchQueue.exe. Attackers can chain arbitrary file write with DLL hijacking in PGImageExchangeQueueSvc.exe, which loads missing DLLs like CRYPTSP.DLL from the application directory, achieving remote code execution as NT Authority\SYSTEM upon service restart.
Risk Assessment
The risk for the organization includes full system compromise by an unauthenticated remote attacker, potentially leading to data theft, malware installation, or disruption of medical services.
Recommendation
Immediately update PACSgear PACS Scan to the latest version, restrict access to TCP port 22222 to trusted hosts only, and consider disabling unnecessary .NET Remoting services.
Original NVD description (English source)
PACSgear PACS Scan 5.2.1 contains an unauthenticated remote code execution vulnerability that allows remote attackers to read and write arbitrary files by exploiting an exposed .NET Remoting TCP service on port 22222 via PGImageExchQueue.exe without any authentication requirement. Attackers can chain the arbitrary file write primitive with DLL hijacking in PGImageExchangeQueueSvc.exe, which loads missing DLLs such as CRYPTSP.DLL from the application directory, to achieve remote code execution as NT Authority\SYSTEM upon service restart.