PT-2024-28460 · Entrust · Entrust Instant Financial Issuance

Omar A. Crespo + 1 · Published 2024-09-23 · Updated 2024-09-26 · CVE-2024-39342

Positive Technologies (AI Summary)

CVSS v3.1

6.6

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L

Name of the Vulnerable Software and Affected Versions Entrust Instant Financial Issuance (formerly known as Cardwizard) versions 6.8.x and earlier, 6.9.0, 6.9.1, 6.9.2, 6.10.0

Description The issue concerns the use of a DLL library with a custom AES encryption process that relies on static hard-coded key values, which are not uniquely generated per installation of the software. This, combined with an encrypted password obtainable from "WebAPI.cfg.xml", makes decryption trivial and can lead to privilege escalation on the Windows host.

Recommendations For versions 6.8.x and earlier, 6.9.0, 6.9.1, 6.9.2, 6.10.0, consider updating to a version that does not use static hard-coded key values for AES encryption, or temporarily restrict access to the DCG.Security.dll library until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Privilege Management

Weakness Enumeration

CWE-269

Related Identifiers

CVE-2024-39342

Affected Products

Entrust Instant Financial Issuance

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2024-39342 · Security Note
• https://trustedcare.entrust.com/login · Note
• https://twitter.com/VulmonFeeds/status/1838321728461664583 · Twitter Post
• https://gist.github.com/VAMorales/21a8700a67d80c263b38e693fd528313 · Note
• https://t.me/cvedetector/6200 · Telegram Post
• https://entrust.com · Note
• https://twitter.com/CVEnew/status/1838282440860750175 · Twitter Post