Executive brief
Unisys WebPerfect Image Suite, a software package used for document imaging and management, contains a security flaw in how it handles license file requests. An attacker can send a specially crafted message to the server that forces it to connect to an outside computer controlled by the attacker. This connection can leak sensitive authentication credentials (NTLMv2 hashes), which the attacker can then use to impersonate the server, gain unauthorized access to other systems, or move through the corporate network.
Technical details
The vulnerability exists in the PILicFileService.dll component of Unisys WebPerfect Image Suite. The ReadLicense action's LFName parameter in the WCF SOAP endpoint (typically on TCP port 1208) accepts unsanitized file paths. Specifically, the OpenLicenseFile function within the LicenseFilePar class passes user-controlled input directly to File.Exists without validation. By supplying a Universal Naming Convention (UNC) path, a remote, unauthenticated attacker can force the server to initiate an outbound SMB connection to an attacker-controlled listener. This process leaks the NTLMv2 machine-account or service-account hashes, which can be used for offline cracking or NTLM relay attacks to achieve lateral movement or privilege escalation. Additionally, the endpoint can be used to verify the existence of local files via path traversal, though file contents are not directly exposed.
Affected products
- Unisys WebPerfect Image Suite 3.0.3960.22810, 3.0.3960.22604
Timeline
- 2026-04-14: disclosed: Initial disclosure by VulnCheck
- 2026-04-14: advisory: NVD published date