Seagull BarTender 2010/BarTender 2016/BarTender 2019 NET Remoting Service BtSystem.Service.exe WebClient missing authentication

Summaryinfo

A vulnerability has been found in Seagull BarTender 2010, BarTender 2016 and BarTender 2019 and classified as critical. This vulnerability affects the function WebClient of the file BtSystem.Service.exe of the component NET Remoting Service. This manipulation causes missing authentication. This vulnerability is handled as CVE-2026-25550. The attack can be initiated remotely. There is not any exploit available.

Detailsinfo

A vulnerability classified as critical was found in Seagull BarTender 2010, BarTender 2016 and BarTender 2019 (the affected version unknown). Affected by this vulnerability is the function WebClient of the file BtSystem.Service.exe of the component NET Remoting Service. The manipulation with an unknown input leads to a missing authentication vulnerability. The CWE definition for the vulnerability is CWE-306. The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

Seagull Software BarTender 2010, 2016, and 2019 contain an unauthenticated remote code execution vulnerability in the .NET Remoting service exposed on TCP port 7375 via BtSystem.Service.exe. The service registers an unauthenticated singleton endpoint — BarTenderSystem for BarTender 2016 <= R9, and DataServiceSingleton for BarTender 2019 <= R10 — configured with BinaryServerFormatterSinkProvider and TypeFilterLevel set to Full. An unauthenticated remote attacker can exploit .NET Remoting object unmarshalling to read or write arbitrary files on the server using the .NET WebClient class, or coerce NTLMv2 authentication by supplying a UNC path to an attacker-controlled server, enabling sensitive credential disclosure, remote code execution, or lateral movement depending on service account privileges and network environment. The service runs in the context of NT AUTHORITY\SYSTEM.

The weakness was released by Victor A. Morales and Jan A. Rodriguez. It is possible to read the advisory at portal.seagullscientific.com. This vulnerability is known as CVE-2026-25550 since 02/02/2026. The exploitation appears to be easy. The attack can be launched remotely. The exploitation doesn't need any form of authentication. Technical details of the vulnerability are known, but there is no available exploit. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 06/04/2026).

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Vendor

• Seagull

Name

• BarTender 2010
• BarTender 2016
• BarTender 2019

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion