PT-2024-25789 · Entrust Datacard · Entrust Datacard Xps Card Printer Driver

Pamoutaf · Published 2024-07-22 · Updated 2024-12-26 · CVE-2024-34329

Positive Technologies (AI Summary)

CVSS v3.1

8.4

High

Base vector

AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Entrust Datacard XPS Card Printer Driver versions 8.5 and earlier without the dxp1-patch-E24-004 patch Entrust Datacard XPS Card Printer Driver versions 8.4 and earlier

Description The issue is related to insecure permissions in the Entrust Datacard XPS Card Printer Driver, allowing unauthenticated attackers to execute arbitrary code as SYSTEM via a crafted DLL payload.

Recommendations For Entrust Datacard XPS Card Printer Driver versions 8.5 and earlier, apply the dxp1-patch-E24-004 patch to resolve the issue. For Entrust Datacard XPS Card Printer Driver versions 8.4 and earlier, update to a version that includes the necessary security fixes, or apply the dxp1-patch-E24-004 patch if available.

Exploit

Fix

Weakness Enumeration

CWE-277

Related Identifiers

CVE-2024-34329

Affected Products

Entrust Datacard Xps Card Printer Driver

References · 12

• 🔥 https://github.com/pamoutaf/CVE-2024-34329/blob/main/README.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-34329 · Security Note
• https://twitter.com/VIPER92929/status/1871621887740232057 · Twitter Post
• https://entrust.com/support/instant-id-card-issuance-systems/ds3-direct-to-card-printer-support · Note
• https://t.me/s_e_reborn/5335 · Telegram Post
• https://t.me/redteambro/410 · Telegram Post
• https://t.me/cvenotify/87083 · Telegram Post
• https://entrust.com/sites/default/files/documentation/productsupport/entrust-security-bulletin-e24-004.pdf · Note
• https://t.me/cvedetector/1480 · Telegram Post
• https://t.me/cybersecuritytechnologies/10891 · Telegram Post
• https://t.me/pentestbacklog/464 · Telegram Post
• https://entrust.com/ja/contact/services/downloads/drivers · Note