CVE-2026-58127: PACSgear MediaWriter 5.2.1 Unauthenticated RCE via .NET Remoting TCP Service
PACSgear MediaWriter 5.2.1 exposes a .NET Remoting TCP service on port 9000 via PacsgearMediaServerEngine.dll, registered with ObjectURIs RemoteObj and UIRemoteObj, without any authentication requirement. By exploiting the MarshalByRefObject object unmarshalling technique and implementing .NET WebClient class methods, an unauthenticated remote attacker can read and write arbitrary files on the host filesystem. The ObjectURIs are identical across all installations by default. Chaining the arbitrary file write primitive with DLL hijacking opportunities in the MediaWriter service (which runs as NT Authority\\SYSTEM and loads missing DLLs such as CRYPTBASE.DLL from the application directory) enables unauthenticated remote code execution as SYSTEM upon service restart.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
PACSgear MediaWriterto a version that resolves this vulnerability.Fixed in 5.2.1 - Compensating control
Immediately restrict network access to PACSgear MediaWriter’s .NET Remoting TCP service on port 9000 (PacsgearMediaServerEngine.dll) to trusted IPs only, since it is exposed without any authentication requirement.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-58127?
CVE-2026-58127 has a critical severity score of 9.3.
How do I fix CVE-2026-58127?
To mitigate CVE-2026-58127, ensure proper authentication mechanisms are implemented for the .NET Remoting TCP service.
What are the potential impacts of CVE-2026-58127?
Exploiting CVE-2026-58127 could allow an unauthenticated remote code execution, compromising the entire system.
Which software is affected by CVE-2026-58127?
CVE-2026-58127 affects PACSgear MediaWriter version 5.2.1.
What is the exposure vector for CVE-2026-58127?
CVE-2026-58127 is exposed over the network, specifically on port 9000 without authentication.