Jan A. Rodriguez

**Name of the Vulnerable Software and Affected Versions** PACSgear PACS Scan version 5.2.1 **Description** An unauthenticated remote code execution issue exists due to an exposed .NET Remoting TCP service on port 22222 used by `PGImageExchQueue.exe`. The flaw stems from insecure remoting endpoints and improper authentication and access control, allowing remote attackers to read and write arbitrary files. This capability can be chained with DLL hijacking in `PGImageExchangeQueueSvc.exe`, which loads missing DLLs such as `CRYPTSP.DLL` from the application directory. Upon service restart, this allows for remote code execution with NT AUTHORITYSYSTEM privileges, potentially leading to complete host takeover, lateral movement, and data theft in clinical imaging environments. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** PACSgear MediaWriter version 5.2.1 **Description** An unauthenticated remote attacker can read and write arbitrary files on the host filesystem by exploiting a .NET Remoting TCP service exposed on port 9000 via `PacsgearMediaServerEngine.dll`. This is possible because the service is registered with ObjectURIs `RemoteObj` and `UIRemoteObj` without authentication requirements. The attack utilizes the MarshalByRefObject object unmarshalling technique and .NET WebClient class methods. Furthermore, chaining the arbitrary file write capability with DLL hijacking in the MediaWriter service—which runs as NT AuthoritySYSTEM and loads missing DLLs like `CRYPTBASE.DLL` from the application directory—allows for remote code execution as SYSTEM upon service restart. **Recommendations** Update PACSgear MediaWriter version 5.2.1 to a patched version.

**Name of the Vulnerable Software and Affected Versions** Calero VeraSMART versions prior to 2022 R1 **Description** An unauthenticated .NET Remoting HTTP service is exposed on TCP port 8001 in affected versions. The service publishes default ObjectURIs, including `EndeavorServer.rem` and `RemoteFileReceiver.rem`, and allows the use of SOAP and binary formatters with TypeFilterLevel set to Full. A remote attacker can invoke the exposed remoting endpoints to perform arbitrary file read and write operations via the `WebClient` class. This can allow retrieval of sensitive files, such as `WebRootweb.config`, potentially disclosing IIS machineKey validation and decryption keys. These keys can be used to generate a malicious ASP.NET ViewState payload, achieving remote code execution within the IIS application context. Supplying a UNC path can trigger outbound SMB authentication from the service account, potentially exposing NTLMv2 hashes for relay or offline cracking. **Recommendations** Update to version 2022 R1 or later.

**Name of the Vulnerable Software and Affected Versions** Calero VeraSMART versions prior to 2026 R1 **Description** The software contains hardcoded static AES encryption keys within the `Veramark.Framework.dll` module, specifically in the `Veramark.Core.Config` class. These keys are used to encrypt the password of the service account stored in `C:VeraSMART Dataapp.settings`. An attacker with local access can extract these keys from the `Veramark.Framework.dll` module and decrypt the stored credentials. The recovered credentials can then be used to authenticate to the Windows host, potentially leading to local privilege escalation depending on the privileges of the configured service account. **Recommendations** Update to version 2026 R1 or later.

**Name of the Vulnerable Software and Affected Versions** Calero VeraSMART versions prior to 2022 R1 **Description** The application uses static machineKey values configured for the VeraSMART web application and stored in 'C:Program Files (x86)VeramarkVeraSMARTWebRootweb.config'. An attacker obtaining these keys can create a valid ASP.NET ViewState payload, bypassing integrity validation. This leads to server-side deserialization and remote code execution within the IIS application context. **Recommendations** Update to version 2022 R1 or later.