PACSgear MediaWriter 5.2.1 Unauthenticated RCE via .NET Remoting TCP Service

published 2026-07-01 4 mo ago modified 2026-10-25 14 d ago also EUVD-2026-41037

cvss: 9.8; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 1.9%; EPSS 1.9% chance of exploitation in 30 days, percentile 79%
public exploits: 0; none known

PACSgear MediaWriter 5.2.1 exposes a .NET Remoting TCP service on port 9000 via PacsgearMediaServerEngine.dll, registered with ObjectURIs RemoteObj and UIRemoteObj, without any authentication requirement. By exploiting the MarshalByRefObject object unmarshalling technique and implementing .NET WebClient class methods, an unauthenticated remote attacker can read and write arbitrary files on the host filesystem. The ObjectURIs are identical across all installations by default. Chaining the arbitrary file write primitive with DLL hijacking opportunities in the MediaWriter service (which runs as NT Authority\\SYSTEM and loads missing DLLs such as CRYPTBASE.DLL from the application directory) enables unauthenticated remote code execution as SYSTEM upon service restart.

CISA SSVC

Exploitation: Proof of concept is public
Automatable: yes
Technical impact: total
Assessed: 4 mo ago (2026-07-01)

Exploit prediction

1.88% chance of exploitation in the next 30 days, higher than 79% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

gist.github.com https://gist.github.com/VAMorales/dc679ecab30b7045fa07bf3249a034d8 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
CNA	4.0	9.3	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CNA	3.1	9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA	4.0	9.3	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Affected products

Hyland PACSgear MediaWriter

Classification

Weakness

CWE-306 Missing Authentication for Critical Functionality
CWE-502 Deserialization of Untrusted Data

References

gist.github.com /VAMorales/dc679ecab30b7045fa07bf3249a034d8
technical-description, exploit, third-party-advisory
hyland.com /en/solutions/products/pacsgear
product
vulncheck.com /advisories/pacsgear-mediawriter-unauthenticated-rce-via-net-remoting-tcp-service
third-party-advisory, vdb-entry

Sources

CVE List CVE-2026-58127
NVD CVE-2026-58127

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary