PACSgear MediaWriter 5.2.1 hosts a .NET Remoting TCP service on port 9000 that is exposed without authentication. The service relies on MarshalByRefObject deserialization, allowing a remote attacker to invoke .NET WebClient methods to read or write any file; the service loads missing DLLs such as CRYPTBASE.DLL from the application directory. Restarting the service with a malicious DLL grants an attacker SYSTEM‑level remote code execution.

The affected product is Hyland PACSgear MediaWriter 5.2.1. Every installation of that version publishes the same unprotected .NET Remoting endpoint on TCP 9000, making any instance reachable on the network vulnerable to the described exploit. The service typically runs as SYSTEM on Windows servers that host the media writer.

The CVSS base score of 9.3 ranks the flaw as critical, while the EPSS score is below 1 %, indicating a very low but non‑zero likelihood of exploitation. The vulnerability is not listed in CISA KEV. Attackers only need network access to port 9000; no authentication or privilege checks protect the service, so read/write file operations and subsequent service restarts give SYSTEM‑level control.