Seagull Software BarTender 2010, 2016, and 2019 expose an unauthenticated .NET Remoting service on TCP port 7375. The service registers a singleton endpoint that uses BinaryServerFormatterSinkProvider with TypeFilterLevel set to Full, allowing a remote attacker to send crafted data that is unmarshalled by the service. This flaw enables the attacker to read or write arbitrary files, supply a UNC path to a controlled server to coerce NTLMv2 authentication, and consequently leak credentials, execute arbitrary code, or facilitate lateral movement depending on the privileges of the service account. The service runs under NT AUTHORITY\\SYSTEM, providing a broad attack surface if exploited.

Affected vendors include Seagull Software, LLC and products are BarTender 2010, BarTender 2016, and BarTender 2019. No other product versions are listed as affected.

With a CVSS score of 9.3 the vulnerability is classified as critical. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is network-based; an unauthenticated attacker can exploit the service from any host that can reach TCP port 7375. Because the service runs as SYSTEM, successful exploitation would grant full control over the host, making this a high‑risk vulnerability in any environment where the service is exposed.