EUVD-2026-41036
GHSA-v3r5-hc9j-49g7
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication required for critical functions
MITRE ATT&CK
1 technique across 1 tactic: Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 01, 2026
Unauthenticated remote code execution in Hyland PACSgear PACS Scan 5.2.1 lets remote attackers gain SYSTEM-level control of medical imaging servers by abusing an exposed .NET Remoting TCP service (PGImageExchQueue.exe) on port 22222. The exposed service grants arbitrary file read/write with no authentication, which is chained with a DLL hijack in the PGImageExchangeQueueSvc.exe service to run code as NT AUTHORITY\SYSTEM. Publicly available exploit code exists (published by VulnCheck); there is no public exploit identified as actively exploited, as it is not listed in CISA KEV.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Know when Pacsgear Pacs Scan gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Primary rating from Vendor (VulnCheck) · only source for this CVE.
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
PACSgear PACS Scan 5.2.1 contains an unauthenticated remote code execution vulnerability that allows remote attackers to read and write arbitrary files by exploiting an exposed .NET Remoting TCP service on port 22222 via PGImageExchQueue.exe without any authentication requirement. Attackers can chain the arbitrary file write primitive with DLL hijacking in PGImageExchangeQueueSvc.exe, which loads missing DLLs such as CRYPTSP.DLL from the application directory, to achieve remote code execution as NT Authority\SYSTEM upon service restart.
Executive ViewAI
Hyland PACSgear PACS Scan 5.2.1 contains an unauthenticated remote code execution vulnerability enabling attackers to obtain SYSTEM-level access to medical imaging servers without authentication. With no patch available, unpatched systems face immediate risk of compromise affecting patient data confidentiality, imaging integrity, and continuity of clinical care operations.
24 hours: Identify all Hyland PACSgear PACS Scan 5.2.1 installations; restrict network access to port 22222 (PGImageExchQueue.exe service) via firewall rules; document business-critical PACS dependencies. 7 days: Implement network segmentation isolating PACS infrastructure; enable enhanced logging for port 22222 connections and service directory file modifications; scan for indicators of compromise (unauthorized DLLs, modified service binaries). 30 days: Upgrade to patched Hyland PACSgear PACS Scan version once released by vendor; verify integrity of all medical imaging data post-upgrade; conduct tabletop exercise for incident response to PACS compromise.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Restrict inbound access to port 22222 at network perimeter and internal firewalls; (2) Disable PGImageExchQueue.exe TCP service if clinical operations permit; (3) Deploy application whitelisting to prevent DLL injection into PGImageExchangeQueueSvc.exe directory; (4) Monitor for anomalous .NET Remoting connections and DLL modifications; (5) Maintain offline backups of critical imaging databases; (6) Implement file integrity monitoring on service executable and DLL directories with daily verification.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Exploit-DB