Executive brief
Spacelabs Healthcare Sentinel, a cardiology information management system used to collect and analyze cardiovascular data, contains a critical security flaw. An unauthenticated attacker can remotely execute commands on the server, potentially allowing them to steal patient data, disrupt clinical operations, or gain a foothold in the hospital network. This vulnerability is only exploitable if the system has been manually configured to expose a specific communication port (8989) to the network.
Technical details
A remote code execution vulnerability exists in Spacelabs Healthcare Sentinel due to a deprecated .NET Remoting HTTP channel exposed on port 8989. The flaw stems from missing authentication (CWE-306) for critical functions, allowing an unauthenticated attacker to perform arbitrary file read and write operations by supplying valid .NET URI endpoints. By writing malicious ASPX webshells to the IIS wwwroot directory, an attacker can achieve full remote code execution. While port 8989 is not exposed by default, exploitation is possible if the port has been made network-accessible through manual configuration or network policy changes. The issue is resolved in version 11.6.0.
Affected products
- Spacelabs Healthcare Sentinel 10.5.x and higher, 11.x.x before 11.6.0
Timeline
- 2026-06-02: disclosed
- 2026-06-02: advisory
References
- https://spacelabshealthcare.com/products/diagnostic-cardiology/connectivity/sentinel
- https://spacelabshealthcare.com/wp-content/uploads/2026/06/079-0273-00-RevA-Security-Advisory-Sentinel-.NET-Remoting-Vulnerability.pdf
- https://www.vulncheck.com/advisories/spacelabs-healthcare-sentinel-x-unauthenticated-rce-via-net-remoting