Altec DocLink version 4.0.336.0 exposes unauthenticated .NET Remoting endpoints accessed through TCP or HTTP/SOAP. The service, Altec.RDCHostService.exe, binds to the object URI 'doclinkServer.soap' and performs unsafe object unmarshalling. This allows a remote actor to specify any file path on the underlying system, read its contents, or write data to arbitrarily chosen locations, including paths that are publicly reachable under IIS. A write to such locations can overwrite web‑executable files and give the attacker the ability to execute code on the server, or cause denial of service by corrupting critical files. The vulnerability is a classic instance of unsafe deserialization (CWE‑502) and can be leveraged without authentication, leading to full remote code execution.

Beyond Limits Inc. maintains Altec DocLink. The affected product is Altec DocLink version 4.0.336.0. No other versions are listed as affected in the CNA data. The product is typically deployed in environments where the Altec.RDCHostService.exe process listens for .NET Remoting traffic on standard TCP/HTTP ports and exposes SOAP endpoints.

The CVSS score of 10 indicates maximum severity, and the EPSS score of 1% reflects a non‑negligible likelihood of exploitation. It is not listed in the CISA KEV catalog, but the presence of unauthenticated access and deserialization flaws strongly suggests that attackers could target the service over the public internet. The likely attack vector involves a remote actor connecting to the vulnerable TCP or HTTP endpoints, crafting a malicious payload that exploits the deserialization process to read or overwrite files and thereby achieve remote code execution.