CVE-2026-58127

The PacsgearMediaServerEngine.dll library registers .NET Remoting objects under the ObjectURIs identifiers RemoteObj and UIRemoteObj, accessible via TCP on port 9000 without any authentication. An attacker can exploit the MarshalByRefObject unmarshalling technique and .NET WebClient class methods to read and write arbitrary files on the host file system. Since the ObjectURIs identifiers are identical in all default installations, the attack is repeatable on every unsecured installation. Combining the file write primitive with a DLL hijacking vulnerability — the MediaWriter service runs as NT Authority\SYSTEM and loads missing libraries (e.g., CRYPTBASE.DLL) from the application directory — enables remote code execution with SYSTEM privileges after service restart.

An unauthenticated remote attacker can read and write arbitrary files on the server, and through DLL hijacking obtain full code execution (RCE) with NT Authority\SYSTEM privileges, resulting in complete compromise of the host operating system.

Apply patches available from the vendor according to the references. Until patches are deployed, it is recommended to block access to TCP port 9000 at the firewall level or through network segmentation, restricting access only to trusted hosts. You should also consider disabling the MediaWriter service if it is not essential.

PACSgear MediaWriter version 5.2.1