Kofax Capture (Tungsten Capture) version 6.0.0.0 exposes an unauthenticated .NET Remoting HTTP channel on port 2424 through the Ascent Capture Service. The vulnerability uses a deprecated remoting channel with a publicly known endpoint identifier. Remote unauthenticated attackers can exploit .NET Remoting object unmarshalling to instantiate System.Net.WebClient objects. This enables arbitrary file read/write operations on the server filesystem. Attackers can coerce NTLMv2 authentication to attacker-controlled hosts for credential disclosure. The vulnerability can lead to denial of service, remote code execution, or lateral movement depending on service privileges.