Executive brief
Unisys WebPerfect Image Suite, a software package used for document imaging and management, contains a security flaw in its communication components. An unauthenticated attacker can remotely force the system to reveal sensitive encrypted credentials (NTLMv2 hashes) belonging to the server's machine account. These stolen credentials can be used to impersonate the server on the network, potentially leading to unauthorized access to other corporate systems or a total takeover of the affected server.
Technical details
The vulnerability exists in the Unisys.SOA.PerfectImageService.exe component, which exposes a deprecated .NET Remoting TCP channel on an ephemeral port. By utilizing object-unmarshalling techniques—specifically targeting the System.Media.SoundPlayer class—an unauthenticated remote attacker can supply a Windows UNC path as a target file argument. This triggers SMB coercion, forcing the server to attempt an outbound connection to an attacker-controlled share, thereby leaking the NTLMv2 hash of the service account. This hash can then be captured and relayed to achieve lateral movement or privilege escalation within the Windows environment.
Affected products
- Unisys WebPerfect Image Suite 3.0.3960.22810, 3.0.3960.22604
Timeline
- 2026-04-14: disclosed
- 2026-04-14: advisory
- 2026-04-23: other: Exploit code published by researcher