Executive brief
PACSgear PACS Scan is a medical imaging solution used to capture and integrate patient data into electronic health records. A critical security flaw allows an unauthenticated attacker to remotely read or write files on the server and execute malicious code with the highest system privileges. This could lead to the complete compromise of the server, theft of sensitive patient data, or disruption of medical imaging workflows.
Technical details
The vulnerability exists in the PGImageExchQueue.exe component, which exposes a .NET Remoting TCP service on port 22222 (ObjectURI: PGImageExchange) without authentication. By exploiting insecure deserialization and missing authentication (CWE-502, CWE-306), a remote attacker can read and write arbitrary files. This primitive can be leveraged for Remote Code Execution (RCE) by placing a malicious DLL (e.g., CRYPTSP.DLL) into the application directory. When the PGImageExchangeQueueSvc.exe service restarts, it attempts to load these missing DLLs, executing the attacker's code with NT Authority\SYSTEM privileges. Exploitation requires network access to the service port but no valid credentials.
Affected products
- Hyland PACSgear PACS Scan 5.2.1
Timeline
- 2026-07-01: disclosed: Public disclosure by researchers from GM Sectec, Corp.
- 2026-07-01: advisory: CVE-2026-58126 published.