PACSgear MediaWriter EUVD-2026-41037

Exploitation requires network reachability to the .NET Remoting TCP service on port 9000 exposed by PacsgearMediaServerEngine.dll on a PACSgear MediaWriter 5.2.1 host; no authentication, credentials, or user interaction are needed (PR:N/UI:N), and the ObjectURIs RemoteObj and UIRemoteObj are identical across all default installations, so no per-target discovery is required. Full RCE (as opposed to file read/write only) additionally depends on the SYSTEM-level MediaWriter service being present and restarting to load the hijacked DLL (e.g. CRYPTBASE.DLL) from the application directory - so achieving SYSTEM code execution is gated on a service restart, though the arbitrary file read/write itself is immediate. The main limiting factor is network exposure of port 9000: on segmented clinical networks the service may not be reachable from an attacker's position.

All signals align toward high real-world risk. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N, VC:H/VI:H/VA:H) describes network-reachable, low-complexity, unauthenticated exploitation with full confidentiality, integrity and availability impact, scored 9.3. Public exploit code exists (VulnCheck gist), and the file-write-to-DLL-hijack chain is deterministic and reliable, which materially raises exploitability beyond the raw score. In SSVC terms this is best treated as Automatable=yes with Technical Impact=total, given identical default ObjectURIs across all installs and a scriptable primitive. No EPSS score was provided in the input, and the CVE is not confirmed in CISA KEV, so widespread active exploitation is not established - the current evidence is public POC plus vendor-grade advisory, not in-the-wild telemetry. Mitigating real-world exposure is that MediaWriter is a niche medical PACS/imaging component, typically deployed on restricted healthcare networks rather than the open internet; exposure depends on whether port 9000 is network-reachable to the attacker.

An attacker with network reachability to TCP port 9000 connects to the unauthenticated .NET Remoting endpoint using the known default ObjectURI (RemoteObj/UIRemoteObj) and, via MarshalByRefObject unmarshalling with WebClient methods, writes a malicious CRYPTBASE.DLL into the MediaWriter application directory. When the SYSTEM-level MediaWriter service next restarts, it loads the planted DLL from its own directory and the attacker gains code execution as NT AUTHORITY\SYSTEM. A public POC (VulnCheck gist) demonstrates the primitive, and the low attack complexity plus identical default URIs make the chain broadly repeatable.