🔴 严重 | CVE-2026-58127 — PACSgear MediaWriter 5.2.1 exposes a .NET Remoting...
🔴 《严重安全漏洞：CVE-2026-58127》
CVSS 评分: 严重（9.3） 状态: Received 发布时间: 2026-07-01
漏洞描述
PACSgear MediaWriter 5.2.1 exposes a .NET Remoting TCP service on port 9000 via PacsgearMediaServerEngine.dll, registered with ObjectURIs RemoteObj and UIRemoteObj, without any authentication requirement. By exploiting the MarshalByRefObject object unmarshalling technique and implementing .NET WebClient class methods, an unauthenticated remote attacker can read and write arbitrary files on the host filesystem. The ObjectURIs are identical across all installations by default. Chaining the arbitrary file write primitive with DLL hijacking opportunities in the MediaWriter service (which runs as NT Authority\SYSTEM and loads missing DLLs such as CRYPTBASE.DLL from the application directory) enables unauthenticated remote code execution as SYSTEM upon service restart.
🔍 技术细节
| 字段 | 值 |
|---|---|
| CVE ID | CVE-2026-58127 |
| CVSS 评分 | 9.3 🔴 |
| 严重程度 | 严重 |
| CVSS 向量 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
| CWE 分类 | CWE-306,CWE-502 |
| 发布时间 | 2026-07-01 |
| 最后更新 | 2026-07-01 |
| 状态 | Received |
🔗 参考链接
🤖 本文由 CVE 安全快讯机器人自动生成 | 数据来源: NVD