Unauthenticated Remote Code Execution in PACSgear PACS Scan 5.2.1

Executive Summary

CVE-2026-58126 is a critical vulnerability in PACSgear PACS Scan version 5.2.1 and below that allows unauthenticated remote attackers to execute arbitrary code on the affected system.

The vulnerability arises because the application exposes a .NET Remoting TCP service on port 22222 via the PGImageExchQueue.exe process without any authentication checks. Attackers can exploit this to read and write arbitrary files on the system.

By leveraging the arbitrary file write capability, attackers can perform DLL hijacking in the PGImageExchangeQueueSvc.exe service, which loads missing DLLs such as CRYPTSP.DLL from the application directory. By replacing these DLLs with malicious payloads, attackers can achieve remote code execution with SYSTEM privileges when the service restarts.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can have severe impacts including full system compromise.

• Attackers can remotely execute code as NT Authority\SYSTEM, the highest privilege level on Windows systems.
• They can read and write arbitrary files without any authentication, potentially leading to data theft, data manipulation, or destruction.
• The system can be fully controlled by attackers, allowing them to install malware, create backdoors, or disrupt services.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by identifying if the PACSgear PACS Scan 5.2.1 or below is running and if the .NET Remoting TCP service is exposed on port 22222 without authentication.

You can scan your network or system for open TCP port 22222 to check if the vulnerable service is exposed.

• Use a network scanning tool like nmap: nmap -p 22222 <target-ip>
• Check running processes for PGImageExchQueue.exe which registers the .NET Remoting service.
• Attempt to connect to the .NET Remoting service on port 22222 to verify if it responds without authentication.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include restricting access to port 22222 to trusted hosts only, such as by firewall rules or network segmentation, to prevent unauthenticated remote access.

If possible, stop or disable the PGImageExchQueue.exe service or the associated .NET Remoting TCP service until a patch or update is applied.

Apply any available patches or updates from the vendor to upgrade PACSgear PACS Scan to a version that fixes this vulnerability.

Monitor for suspicious activity such as unexpected file writes or service restarts that could indicate exploitation attempts.

Useful 0 Not Useful 0