CVE-2026-58127
CriticalCVSS 9.8Exploitation Probability (EPSS)
Elevated risk58th percentile - higher than 58% of all known CVEs
Summary
PACSgear MediaWriter 5.2.1 exposes an unauthenticated .NET Remoting service on port 9000, allowing an unauthenticated attacker to read and write arbitrary files remotely. Chaining this with DLL hijacking enables remote code execution as SYSTEM.
Risk Assessment
An attacker can gain full control over the PACS server, accessing sensitive medical data and disrupting system operations.
Recommendation
Immediately block access to port 9000 on the firewall and contact the vendor for a patch that addresses the vulnerability.
Original NVD description (English source)
PACSgear MediaWriter 5.2.1 exposes a .NET Remoting TCP service on port 9000 via PacsgearMediaServerEngine.dll, registered with ObjectURIs RemoteObj and UIRemoteObj, without any authentication requirement. By exploiting the MarshalByRefObject object unmarshalling technique and implementing .NET WebClient class methods, an unauthenticated remote attacker can read and write arbitrary files on the host filesystem. The ObjectURIs are identical across all installations by default. Chaining the arbitrary file write primitive with DLL hijacking opportunities in the MediaWriter service (which runs as NT Authority\\SYSTEM and loads missing DLLs such as CRYPTBASE.DLL from the application directory) enables unauthenticated remote code execution as SYSTEM upon service restart.