Unisys WebPerfect Image Suite versions 3.0.3960.22810 and 3.0.3960.22604 expose a WCF SOAP endpoint listening on TCP port 1208 that accepts an unsanitized file path. By submitting a crafted SOAP request containing an UNC path to the ReadLicense action, a remote attacker can cause the server to initiate an outbound SMB connection. The SMB authentication process then transmits NTLMv2 machine‑account hashes, which the attacker can capture. This flaw allows an unauthenticated attacker to obtain potentially privileged credentials that could be relayed for lateral movement or privilege escalation within the network. The weakness is a classic example of external input used to construct a system path, classified as CWE‑73.

The vulnerability affects the Unisys WebPerfect Image Suite product. Specifically, the impacted releases are 3.0.3960.22810 and 3.0.3960.22604. These versions include the unauthenticated WCF SOAP endpoint on port 1208, which is required for exploitation.

The CVSS score is 7, indicating moderate to high severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is remote over the network, where an attacker submits a malware‑injected SOAP request to the exposed endpoint. Because authentication is not required, any host with network access to port 1208 can trigger the hash leakage. Given the medium‑high CVSS and the potential for compromised credentials, the risk to an environment that hosts the affected product is significant, especially if SMB traffic is allowed to external or untrusted networks.