The vulnerability in Hyland PACSgear MediaWriter 5.2.1 arises from an exposed .NET Remoting TCP service via PacsgearMediaServerEngine.dll on port 9000, registered with fixed ObjectURIs (RemoteObj and UIRemoteObj) that require no authentication. Attackers can exploit the MarshalByRefObject unmarshalling technique combined with .NET WebClient class methods to perform arbitrary file read and write operations remotely. Because the service runs with NT Authority\SYSTEM privileges and loads missing DLLs from the application directory, attackers can chain this file write capability with DLL hijacking to achieve unauthenticated remote code execution as SYSTEM upon service restart.

An unauthenticated remote attacker can gain full control over the affected system by reading and writing arbitrary files, leading to remote code execution with SYSTEM privileges. This poses a critical risk to confidentiality, integrity, and availability of the host system running PACSgear MediaWriter 5.2.1.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict network access to port 9000 on affected systems to trusted users only and monitor for suspicious activity related to the PACSgear MediaWriter service. Avoid restarting the service if exploitation is suspected to prevent code execution via DLL hijacking.