Kofax Capture 6.0.0.0 exposes a deprecated .NET Remoting HTTP channel on port 2424 that requires no authentication and uses a standard endpoint identifier. An attacker can exploit the channel’s object unmarshalling to create a System.Net.WebClient instance, allowing arbitrary reading and writing of files on the server filesystem, or coercing NTLMv2 authentication to an attacker‑controlled host. This can result in data theft, denial‑of‑service, remote code execution, or lateral movement depending on the privileges of the service account. The flaw is grounded in CWE‑306 (Authentication Bypass) and CWE‑441 (Unrestricted Resource Manipulation of Files and Directories).

The vulnerability affects Kofax Capture (now called Tungsten Capture) version 6.0.0.0; other versions may also be impacted. The affected product is delivered by Tungsten Automation and configured with a .NET Remoting HTTP channel on port 2424. If your environment runs this version or earlier builds, it is likely susceptible.

The CVSS base score of 9.3 classifies the issue as critical. The EPSS score of less than 1% indicates that, at present, attackers are unlikely to have exploited the flaw widely, and it is not listed in CISA’s KEV catalog. Nevertheless, the vulnerability is exploitable from any network location that can reach port 2424, making it a high‑risk attack surface for organizations that expose Kofax Capture to the Internet or insecure internal networks. If compromised, an attacker can read or write any file the service account can access, pull NTLMv2 credentials, perform denial‑of‑service or execute arbitrary code on the host. The attack vector is a remote, unauthenticated HTTP session to the .NET Remoting endpoint.