A critical authentication bypass and insecure remoting vulnerability in Tungsten Capture allows unauthenticated remote attackers to execute arbitrary code or exfiltrate sensitive files.

The application utilizes a deprecated .NET Remoting HTTP channel on port 2424 that lacks authentication, allowing unauthenticated attackers to leverage object unmarshalling to perform unauthorized actions.

The CVSS score of 9.8 underscores the extreme risk of this vulnerability. Exploitation can lead to full system compromise, unauthorized access to sensitive business documents, credential theft via NTLM coercion, and lateral movement within the network, causing significant business disruption and data breaches.

Immediate Action: Update to the latest version of Tungsten Capture as recommended by the vendor. If patching is delayed, block all inbound traffic to port 2424 at the network perimeter.

Proactive Monitoring: Review logs for unusual access to the Ascent Capture Service and monitor for unauthorized file read/write operations or suspicious SMB/NTLM traffic originating from the server.

Compensating Controls: Use a Web Application Firewall (WAF) or network-level access control list (ACL) to restrict access to port 2424 to authorized management consoles only.

Public Exploit Available: No (exploit_available: unknown)

Given the multiple high-impact attack vectors enabled by this vulnerability, immediate remediation is mandatory. Administrators must ensure that the Tungsten Capture service is not accessible to unauthorized users and apply the necessary vendor updates to remove the exposed, insecure interface.