EUVD-2026-22726
GHSA-8jpv-7gww-9r9j
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessScan for TCP 1208
-
DeliveryCraft SOAP request with UNC path
-
ExploitTrigger SMB authentication
-
ExecutionCapture NTLMv2 hash
-
PersistRelay to target system
-
ImpactEscalate privileges
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V5 - File Handling File name/path control
|
| Exploitation Conditions | Requires Unisys WebPerfect Image Suite versions 3.0.3960.22810 or 3.0.3960.22604 with unauthenticated WCF SOAP endpoint exposed on TCP port 1208. Remote attacker sends crafted SOAP requests with UNC paths to ReadLicense action's LFName parameter. No authentication or victim interaction required. |
| Impact | Real-world risk is moderate-to-high for organizations running affected Unisys WebPerfect Image Suite versions with port 1208 exposed. The CVSS 7.0 score reflects network exploitability (AV:N), no authentication requirement (PR:N), and high subsequent system impact (SC:H/SI:H), indicating potential for lateral movement beyond the vulnerable component. Attack complexity is low (AC:L), making exploitation accessible to moderately skilled attackers. EPSS data not provided, but NTLM relay attacks are well-understood techniques with extensive tooling (Responder, ntlmrelayx) available in penetration testing frameworks. The vulnerability is NOT confirmed actively exploited per CISA KEV data, and no public exploit identified at time of analysis. However, the attack pattern (SMB coercion via path injection) is documented in numerous prior CVEs and requires minimal customization. Primary risk factors include: exposed port 1208 to untrusted networks, presence of high-privilege machine accounts, lack of SMB signing enforcement, and absence of network segmentation. Organizations with robust SMB security controls (signing required, EPA enabled) face reduced relay risk but still leak hash material for offline cracking. Priority depends on exposure context-internet-facing installations warrant immediate action, while isolated internal deployments have lower urgency. |
| Exploit ScenarioDerived | An external attacker scans internet-facing networks and discovers TCP port 1208 open on a WebPerfect Image Suite server. The attacker crafts a SOAP request to the ReadLicense action with LFName parameter set to a UNC path pointing to their controlled server (e.g., \\attacker.evil.com\share\license.dat). When the vulnerable WCF service processes this request, the Windows host attempts SMB authentication to the attacker's server, automatically transmitting the NTLMv2 hash of the machine account. The attacker captures this hash using Responder, then relays it via ntlmrelayx to a domain controller or file server where SMB signing is not enforced, gaining administrative access for data exfiltration or ransomware deployment across the network. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Apr 14, 2026
Unisys WebPerfect Image Suite 3.0.3960.22810 and 3.0.3960.22604 leak NTLMv2 machine-account hashes through an unauthenticated SOAP endpoint on TCP port 1208, enabling remote attackers to force SMB authentication attempts and relay credentials for privilege escalation or lateral movement. The WCF service accepts unsanitized file paths in the ReadLicense action, allowing UNC path injection to trigger outbound SMB connections. CVSS 7.0 with network attack vector, low complexity, and no authentication required (PR:N). No public exploit code identified at time of analysis, though the attack technique is straightforward for adversaries familiar with NTLM relay tactics.
RemediationAI
Contact Unisys support immediately to obtain patched versions of WebPerfect Image Suite addressing the unsanitized path handling in the WCF SOAP endpoint. No vendor-released patch version independently confirmed from available data at time of analysis-consult Unisys advisories or support channels referenced at https://www.unisys.com/solutions/cai/applications/ for update availability. As immediate mitigation, restrict network access to TCP port 1208 using firewall rules to permit only trusted management systems or disable the WCF service if not operationally required. Implement SMB signing enforcement (required, not just enabled) across the Windows environment to prevent NTLM relay attacks even if hashes are leaked. Deploy Extended Protection for Authentication (EPA) on SMB services to bind authentication to TLS channels. Monitor outbound SMB connections from WebPerfect Image Suite servers to detect exploitation attempts. Consider network segmentation to isolate document management systems from high-value targets accessible via relayed credentials. Apply principle of least privilege to service accounts running the WCF endpoint to limit lateral movement impact.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability resides in a Windows Communication Foundation (WCF) SOAP service exposing a ReadLicense action that processes file paths via the LFName parameter. The underlying flaw (CWE-73: External Control of File Name or Path) occurs when the application fails to sanitize user-supplied input before using it in file system operations. When an attacker provides a UNC path (e.g., \\attacker-server\share\file), Windows automatically initiates SMB authentication to the remote server, transmitting NTLMv2 hashes of the machine account running the service. This is a Server Message Block (SMB) coercion vulnerability pattern commonly exploited in Windows environments. The service listens on TCP 1208, providing a remotely accessible attack surface without authentication barriers. The CVSS 4.0 vector indicates low attack complexity (AC:L) and present attack requirements (AT:P), suggesting attackers need specific environmental conditions or timing but minimal technical sophistication once access to port 1208 is achieved.
Know when Webperfect Image Suite gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:H/SA:N
Primary rating from Vendor (vulncheck) · only source for this CVE.
CVSS VectorVendor: vulncheck
DescriptionCVE.org
Unisys WebPerfect Image Suite versions 3.0.3960.22810 and 3.0.3960.22604 expose an unauthenticated WCF SOAP endpoint on TCP port 1208 that accepts unsanitized file paths in the ReadLicense action's LFName parameter, allowing remote attackers to trigger SMB connections and leak NTLMv2 machine-account hashes. Attackers can submit crafted SOAP requests with UNC paths to force the server to initiate outbound SMB connections, exposing authentication credentials that may be relayed for privilege escalation or lateral movement within the network.
Executive ViewAI
Unisys WebPerfect Image Suite versions 3.0.3960.22810 and 3.0.3960.22604 expose an unauthenticated network service on port 1208 that leaks machine-account NTLMv2 credentials, allowing attackers to relay those credentials for lateral movement and privilege escalation across the network without any authentication. Organizations running this software face immediate risk of credential compromise and post-exploitation access if exposed to untrusted networks.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Disable or block inbound access to TCP port 1208 via firewall rules; (2) Implement network segmentation to prevent outbound SMB connections from affected systems; (3) Deploy NTLM relay prevention controls (enforce SMB signing, disable NTLM if possible); (4) Monitor for suspicious outbound SMB authentication attempts from systems running WebPerfect; (5) Restrict service account privileges on affected servers to minimize lateral movement impact.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Exploit-DB