EUVD-2026-41037
GHSA-9h7v-mf98-p6r6
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Unauthenticated network-reachable remoting service with no user interaction (AV:N/AC:L/PR:N/UI:N) yielding SYSTEM-level file read/write and code execution, so C/I/A all High.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
PACSgear MediaWriter 5.2.1 exposes a .NET Remoting TCP service on port 9000 via PacsgearMediaServerEngine.dll, registered with ObjectURIs RemoteObj and UIRemoteObj, without any authentication requirement. By exploiting the MarshalByRefObject object unmarshalling technique and implementing .NET WebClient class methods, an unauthenticated remote attacker can read and write arbitrary files on the host filesystem. The ObjectURIs are identical across all installations by default. Chaining the arbitrary file write primitive with DLL hijacking opportunities in the MediaWriter service (which runs as NT Authority\\SYSTEM and loads missing DLLs such as CRYPTBASE.DLL from the application directory) enables unauthenticated remote code execution as SYSTEM upon service restart.
AnalysisAI
Unauthenticated remote code execution as SYSTEM affects Hyland PACSgear MediaWriter 5.2.1, which exposes an unauthenticated .NET Remoting TCP service (PacsgearMediaServerEngine.dll) on port 9000. Remote attackers abuse the MarshalByRefObject unmarshalling technique against the default ObjectURIs (RemoteObj/UIRemoteObj) to gain an arbitrary file read/write primitive, then chain it with DLL hijacking to execute code as NT AUTHORITY\SYSTEM. Publicly available exploit code exists (published by VulnCheck), making this a high-priority issue despite no CISA KEV listing at time of analysis.
Technical ContextAI
.NET Remoting is a legacy Microsoft RPC framework that serializes objects across a TCP channel; when a server exposes MarshalByRefObject-derived endpoints without authentication, an attacker can force the server to unmarshal attacker-controlled objects and invoke methods on framework classes such as System.Net.WebClient, yielding arbitrary file read and write on the host. Here the service registers two fixed, install-invariant ObjectURIs (RemoteObj and UIRemoteObj) on port 9000, so no per-target enumeration is needed. The root cause maps to CWE-306 (Missing Authentication for a Critical Function): a security-sensitive remoting interface is reachable with no credential check. The write primitive becomes RCE because the separately-running MediaWriter service, executing as SYSTEM, searches its own application directory for missing DLLs (e.g. CRYPTBASE.DLL) - a classic DLL search-order hijack - so a planted DLL is loaded with SYSTEM privileges when the service restarts. Affected product per CPE: cpe:2.3:a:hyland:pacsgear_mediawriter.
RemediationAI
No vendor-released patch version is identified in the available data, so the primary action is to contact Hyland for a fixed release and consult the VulnCheck advisory (https://www.vulncheck.com/advisories/pacsgear-mediawriter-unauthenticated-rce-via-net-remoting-tcp-service). As compensating controls, block or firewall inbound access to TCP port 9000 so the .NET Remoting service is reachable only from explicitly trusted management hosts - trade-off: any legitimate remoting clients must be added to the allowlist or they will break. Where feasible, disable or stop the exposed remoting listener if the deployment does not require it, accepting loss of the associated MediaWriter remoting functionality. Harden against the DLL-hijack second stage by ensuring the required DLLs (e.g. CRYPTBASE.DLL) are present and by restricting write permissions on the MediaWriter application directory so a low-integrity write cannot plant a DLL - trade-off: tightened ACLs may interfere with in-place updates. Isolate the host on a segmented clinical VLAN and monitor for unexpected file writes into the application directory and for service restarts.
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today