Executive brief
Hyland PACSgear MediaWriter, a solution used for recording medical images to physical media, contains a critical security flaw in its network communication service. An unauthenticated attacker can remotely read or write files on the server, potentially leading to a full takeover of the system. This could result in the theft of sensitive patient data or a complete disruption of medical imaging workflows.
Technical details
The vulnerability exists in the PacsgearMediaServerEngine.dll, which exposes a .NET Remoting TCP service on port 9000 using default ObjectURIs (RemoteObj and UIRemoteObj) without authentication. By exploiting MarshalByRefObject unmarshalling and .NET WebClient methods, an unauthenticated remote attacker can perform arbitrary file reads and writes. This primitive can be escalated to Remote Code Execution (RCE) by writing a malicious DLL (e.g., CRYPTBASE.DLL) to the application directory, exploiting a DLL hijacking vulnerability in the PacsgearMediaWriterService.exe which runs as NT Authority\SYSTEM. RCE is triggered upon service restart.
Affected products
- Hyland PACSgear MediaWriter 5.2.1
Timeline
- 2026-07-01: disclosed: Vulnerability disclosed by researchers from GM Sectec, Corp.
- 2026-07-01: advisory: NVD and VulnCheck published advisories.