CVE-2026-58126

The vulnerability results from the exposure of a .NET Remoting TCP service on port 22222 by the PGImageExchQueue.exe process, which requires no authentication (CWE-306). An attacker can exploit this service to read and write arbitrary files on the system. Then, through DLL hijacking technique, the attacker plants a malicious DLL (e.g., CRYPTSP.DLL) in the application directory, which is loaded by the PGImageExchangeQueueSvc.exe service when the appropriate file is missing. After service restart, the malicious code is executed with NT Authority\SYSTEM privileges (CWE-502 — unsafe deserialization in .NET Remoting).

An attacker gains full arbitrary code execution on the vulnerable system with NT Authority\SYSTEM privileges, which means complete takeover of the host, including the ability to read, modify and delete data, as well as further lateral movement in the network.

Security patches available from the vendor should be applied according to the references. Until the patch is applied, it is recommended to block access to TCP port 22222 at the firewall level and limit the system's exposure exclusively to trusted internal network segments.

PACSgear PACS Scan version 5.2.1