CVE-2026-0611

Executive Summary

CVE-2026-0611 is a critical unauthenticated remote code execution (RCE) vulnerability affecting Spacelabs Healthcare Sentinel versions 10.5.x and higher, prior to 11.6.0. The flaw resides in a deprecated .NET Remoting HTTP channel exposed on TCP port 8989. An attacker can supply valid .NET URI endpoints to perform arbitrary file read and write operations. By writing an ASPX webshell to the IIS wwwroot directory, the attacker achieves unauthenticated RCE on the system. Although port 8989 is not exposed by default, deliberate configuration or network policy changes can make it accessible. The CVSS score is 9.8 (Critical), and no official patch has been released as of this report. The EPSS score is 0.0%, indicating low exploitation likelihood in the wild, but the technical impact is severe.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It affects a proprietary healthcare device management platform (Spacelabs Sentinel) and is not part of a software supply chain ecosystem.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Base Score: 9.8 (Critical)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: High (I:H)
• Availability Impact: High (A:H)

The threat level is Critical due to the lack of authentication, low complexity, and full compromise of confidentiality, integrity, and availability.

Deep Dive & Mechanics

The vulnerability exists in the .NET Remoting HTTP channel exposed on port 8989. .NET Remoting is a deprecated technology that allows objects to interact across application domains or network boundaries. In this implementation, the channel does not enforce authentication, allowing an attacker to send crafted .NET Remoting requests.

The attack flow:

1. The attacker identifies a Sentinel instance with port 8989 exposed.
2. The attacker sends a .NET Remoting request to a valid URI endpoint (e.g., http://target:8989/RemotingEndpoint).
3. The request triggers arbitrary file read/write operations due to insecure deserialization or improper access controls.
4. The attacker writes an ASPX webshell to the IIS wwwroot directory (e.g., C:\inetpub\wwwroot\shell.aspx).
5. The attacker accesses the webshell via HTTP, achieving unauthenticated RCE.

The root cause is the use of a deprecated, unauthenticated .NET Remoting channel that allows arbitrary file operations without proper validation.

Vulnerable vs. Patched Code

Vulnerable Code (Sentinel < 11.6.0): The .NET Remoting HTTP channel is configured without authentication and exposes endpoints that allow file read/write. Example configuration snippet:

<system.runtime.remoting>
  <application>
    <channels>
      <channel ref="http" port="8989" />
    </channels>
  </application>
</system.runtime.remoting>

Patched Code (Sentinel 11.6.0): The .NET Remoting channel is removed or replaced with a secure alternative. The patch disables the HTTP channel on port 8989 and implements proper authentication and input validation. Example patched configuration:

<system.runtime.remoting>
  <application>
    <channels>
      <!-- HTTP channel removed -->
    </channels>
  </application>
</system.runtime.remoting>

Exploitation & Lab Setup

Red Team

Prerequisites:

• Target running Sentinel < 11.6.0 with port 8989 exposed.
• Attacker machine with .NET framework or a tool to craft .NET Remoting requests.

Exploitation Steps:

1. Scan for port 8989:

   nmap -p 8989 <target_ip>
   

2. Use a .NET Remoting exploitation tool (e.g., ysoserial.net or custom script) to send a crafted request:

   // Example using System.Runtime.Remoting.Channels.Http
   using System;
   using System.Runtime.Remoting.Channels;
   using System.Runtime.Remoting.Channels.Http;
   
   class Exploit
   {
       static void Main()
       {
           HttpChannel channel = new HttpChannel();
           ChannelServices.RegisterChannel(channel, false);
           // Craft URI to write webshell
           string uri = "http://target:8989/RemotingEndpoint?file=..\\..\\inetpub\\wwwroot\\shell.aspx&content=<%@ Page Language=\"C#\" %><% Response.Write(\"Hello\"); %>";
           // Trigger file write
           // (Actual exploitation requires deeper understanding of the endpoint)
       }
   }
   

3. Access the webshell:

   curl http://target/shell.aspx
   

Note: No public exploit code is available from Exploit-DB. The above is a conceptual example.

Blue Team

Detection:

• Monitor for connections to port 8989 from untrusted IPs.
• Look for unusual .NET Remoting traffic (e.g., HTTP requests with application/octet-stream content type).
• Detect file writes to IIS wwwroot directory (e.g., C:\inetpub\wwwroot\*.aspx).

Hunting:

• Search for ASPX files with suspicious content (e.g., Process.Start, System.Diagnostics).
• Review IIS logs for POST requests to /shell.aspx or similar.

Indicators of Compromise (IOCs)

• Network:
  • Inbound connections to TCP port 8989 from external IPs.
  • HTTP requests with Content-Type: application/octet-stream to port 8989.
• File System:
  • Unexpected ASPX files in C:\inetpub\wwwroot\ (e.g., shell.aspx, cmd.aspx).
  • Files with recent creation timestamps in the wwwroot directory.
• Process:
  • w3wp.exe spawning cmd.exe or powershell.exe.
• Registry:
  • Changes to HKLM\SOFTWARE\Microsoft\.NETFramework\v4.0.30319\ (unlikely but possible).

Detection Engineering

YARA Rule

rule CVE_2026_0611_Webshell
{
    meta:
        description = "Detects ASPX webshells associated with CVE-2026-0611"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2026-0611"
    strings:
        $s1 = "<%@ Page Language=\"C#\" %>" ascii nocase
        $s2 = "Process.Start" ascii nocase
        $s3 = "System.Diagnostics" ascii nocase
        $s4 = "RunCmd" ascii nocase
    condition:
        any of ($s*) and filesize < 10KB
}

Sigma Rule

title: CVE-2026-0611 .NET Remoting Exploitation Attempt
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects network connections to port 8989 and subsequent webshell access
author: Valters IT
logsource:
    category: network_connection
    product: windows
detection:
    selection:
        DestinationPort: 8989
        Initiated: true
    condition: selection
falsepositives:
    - Legitimate Sentinel administration
level: high

Suricata Rule

alert tcp $EXTERNAL_NET any -> $HOME_NET 8989 (msg:"CVE-2026-0611 .NET Remoting Exploitation Attempt"; flow:to_server,established; content:"|00 01 00 00 00 ff ff ff ff|"; depth:8; reference:cve,2026-0611; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade to Sentinel version 11.6.0 or later.
2. If upgrade is not possible, block port 8989 at the network perimeter using firewall rules.
3. Disable the .NET Remoting HTTP channel in the configuration file (web.config or app.config).

Long-term:

• Replace .NET Remoting with a secure alternative (e.g., WCF with HTTPS and authentication).
• Implement network segmentation to limit exposure of management interfaces.
• Conduct regular vulnerability scans and penetration tests.

Workaround:

• If port 8989 must remain open, restrict access to trusted IPs only using firewall ACLs.

Valters IT
DevSecOps & Cyber Threat Intelligence Expert