Hyland PACSgear PACS Scan 5.2.1 contains a critical vulnerability due to an exposed .NET Remoting TCP service on port 22222 via PGImageExchQueue.exe that does not require authentication. This allows remote attackers to read and write arbitrary files. The vulnerability can be chained with DLL hijacking in PGImageExchangeQueueSvc.exe, which loads missing DLLs such as CRYPTSP.DLL from the application directory. This chain enables remote code execution with SYSTEM privileges upon service restart.

Successful exploitation allows unauthenticated remote attackers to execute arbitrary code with NT Authority\SYSTEM privileges on the affected system. This can lead to full system compromise, unauthorized data access, and persistent control over the host running PACSgear PACS Scan 5.2.1.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict network access to port 22222 to trusted hosts only and monitor for unusual activity related to PGImageExchQueue.exe and PGImageExchangeQueueSvc.exe. Avoid restarting the service unnecessarily to reduce risk of DLL hijacking exploitation.