CVE-2026-58127: PACSgear MediaWriter 5.2.1 Unauthenticated RCE via .NET Remoting TCP Service

Synopsis

An unauthenticated remote code execution vulnerability exists in PACSgear MediaWriter 5.2.1, caused by an exposed .NET Remoting TCP service on port 9000 that requires no credentials. The service is reachable over the network without any authentication, and the attack requires no user interaction. Successful exploitation lets an attacker read and write arbitrary files on the host and, by chaining a DLL hijack against the MediaWriter service process running as NT Authority\\SYSTEM, execute arbitrary code with full system privileges. No fix version has been published; HarborGuard is tracking the advisory for patch availability.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the target host over the network on TCP port 9000, where the .NET Remoting service listens by default.

• AuthenticationNot required

  The exposed .NET Remoting service accepts connections with no credentials; any unauthenticated network client can interact with the registered ObjectURIs.

• Victim interactionNot required

  No user action is needed; the attacker interacts directly with the listening service without involving any human on the target system.

• Attack complexityDetail

  Exploit conditions are reliable and free of race conditions or environmental dependencies, as the ObjectURIs are static and identical across all default installations.

Blast Radius

• Reads arbitrary files from the host filesystem, including credential stores, configuration files, and sensitive application data.
• Writes arbitrary files to any path accessible by the service process, enabling placement of malicious DLLs or overwriting of existing binaries.
• Achieves code execution as NT Authority\\SYSTEM by dropping a rogue DLL (such as CRYPTBASE.DLL) into the application directory and triggering a service restart, granting full control of the host operating system.
• A SYSTEM-level foothold allows an attacker to pivot to other services, extract credentials from memory, and disable local security controls.