CVE-2026-0611

Vulnerability

Spacelabs Healthcare Sentinel versions 10.5.x and higher and 11.x.x before 11.6.0 contain an unauthenticated remote code execution vulnerability. This vulnerability exists within a deprecated .NET Remoting HTTP channel that is exposed on port 8989. Exploitation requires that this port has been explicitly made network-accessible through deliberate configuration or network policy changes, as it is not exposed in a default installation [1].

Exploitation

An attacker can exploit this vulnerability by supplying valid .NET URI endpoints to the exposed .NET Remoting HTTP channel. This allows for arbitrary file read and write operations. By writing an ASPX webshell to the IIS wwwroot directory, an attacker can achieve unauthenticated remote code execution on the affected system.

Impact

Successful exploitation of this vulnerability allows an attacker to achieve unauthenticated remote code execution on the affected system. This is achieved by writing an ASPX webshell to the IIS wwwroot directory, granting the attacker full control over the compromised system with the privileges of the IIS worker process.

Mitigation

Spacelabs Healthcare Sentinel versions 11.6.0 and later contain a fix for this vulnerability. Users are advised to upgrade to a patched version. No workarounds or specific mitigation steps beyond restricting network access to port 8989 have been disclosed in the available references.