External risk intelligence

Seagull Software BarTender .NET Remoting Service Unauthenticated Remote Code Execution

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-25550

The vulnerability exists in a .NET Remoting service (BtSystem.Service.exe) on TCP port 7375 used for label printing management. While the service is network-reachable, such internal application services are typically intended for local or internal network use within a print environment rather than being directly exposed to the public internet by design.

Missing Authentication

Halo Surface Signal: 3 out of 5 — possibly public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

Seagull Software's BarTender product has a critical vulnerability in its .NET Remoting service, accessible over a specific network port. An unauthenticated attacker could potentially execute arbitrary code or gain access to sensitive credentials by exploiting this flaw, impacting the integrity and confidentiality of systems.

Unauthenticated attackers can exploit a service flaw.
This could lead to sensitive data disclosure or code execution.
Assess relevance and exposure to critical systems.

Attack Path

How an attacker could exploit the issue

An unauthenticated attacker can exploit a vulnerability in the .NET Remoting service of Seagull Software BarTender to gain remote code execution. This service, running on TCP port 7375, is accessible over the network and lacks authentication. By sending specially crafted .NET Remoting objects, an attacker can trigger arbitrary file reads/writes or credential theft, potentially leading to full server compromise.

Network accessible, unauthenticated service
Malicious .NET Remoting object unmarshalling
Arbitrary file access, credential theft, RCE

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated remote attacker to execute code on the server by exploiting how the .NET Remoting service handles object unmarshalling. This could lead to unauthorized access to or modification of server files, disclosure of credentials, or further network intrusion, especially given that the service runs with high privileges (NT AUTHORITY\\SYSTEM).

Server files and system access.
Unauthenticated .NET Remoting object unmarshalling.
Remote code execution or credential theft.

Operational Fix

Recommended remediation, mitigation, and detection steps

The .NET Remoting service in Seagull Software BarTender, running as NT AUTHORITY\\SYSTEM, presents a critical remote code execution risk. This service, accessible via TCP port 7375, is likely managed by an infrastructure or platform team responsible for the application's deployment and operation. The initial practical step involves identifying all instances of BarTender, determining their network exposure and business criticality, and then locating the asset owner to plan remediation based on assessed risk.

Identify application owners and infrastructure teams.
Verify network exposure and business criticality.
Plan remediation by asset risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Seagull Software BarTender and why does it use a .NET Remoting service?

BarTender is a widely used software platform designed for designing, automating, and managing the printing of labels, barcodes, and RFID tags. It often operates in industrial or supply chain environments to manage production workflows. The .NET Remoting service, specifically BtSystem.Service.exe, facilitates communication between different components of the BarTender system over a network, allowing the software to coordinate printing tasks across various devices and servers.

How does CVE-2026-25550 allow an attacker to gain control of a server?

This vulnerability involves insecure deserialization, categorized as CWE-502, combined with missing authentication, CWE-306. Because the .NET Remoting service is configured to process incoming objects without verifying who sent them, an attacker can send a specially crafted object. When the service processes this object, it inadvertently executes unintended code, allowing the attacker to perform actions with the high privileges of the system account running the service.

Do I need to send a specific file to trigger this vulnerability?

No, you do not need to send a file. The vulnerability is triggered by an attacker sending malicious, malformed .NET Remoting objects directly to the service over TCP port 7375. The flaw exists because the service is configured to blindly accept and unmarshal these objects. Simply interacting with the service by sending the correct network request is enough to trigger the flaw; it does not require an existing file on the server to be uploaded or manipulated beforehand.

Is my system at risk if it only communicates with internal print controllers?

According to Halo Surface Signal, this service is typically intended for use within internal print environments. While it is not designed to be public-facing, it remains reachable over the network. If your network allows any device or user to connect to TCP port 7375 on the host running BarTender, those internal segments could be paths for exploitation. You should care if your internal security model assumes that local network traffic is inherently trusted or unmonitored.

What is the first step I should take to address this issue?

Begin by auditing your infrastructure to locate all instances of BarTender running the affected versions. Identify which servers have the service listening on TCP port 7375. Once identified, consult with your infrastructure team to verify if these ports are reachable from unauthorized network segments. Restricting access to this port to only known, essential internal systems is a recommended immediate measure while you coordinate with the vendor for official guidance.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.