PT-2025-50149 · Entrust · Entrust Instant Financial Issuance (Ifi) On Premise+1

Published

1999-01-01

·

Updated

2025-12-10

·

CVE-2025-34414

CVSS v4.0

9.3

Critical

VectorAV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Name of the Vulnerable Software and Affected Versions Entrust Instant Financial Issuance (IFI) On Premise software (formerly referred to as CardWizard) versions 5.x through 6.10.5 and versions prior to 6.11.1
Description The software has an insecure .NET Remoting exposure in the Legacy Remoting Service, which is enabled by default. The service registers a TCP remoting channel with SOAP and binary formatters configured at TypeFilterLevel=Full and exposes default ObjectURI endpoints. An unauthenticated remote attacker who can reach the remoting port can invoke the exposed remoting objects to read arbitrary files from the server and coerce outbound authentication, potentially achieving arbitrary file write and remote code execution via known .NET Remoting exploitation techniques. This could lead to disclosure of sensitive installation and service-account data and compromise of the affected host.
Recommendations Versions 5.x through 6.10.5 should be updated to version 6.10.5 or later. Versions prior to 6.11.1 should be updated to version 6.11.1 or later.

Fix

RCE

Missing Authentication

Deserialization of Untrusted Data

Weakness Enumeration

CWE-306CWE-502

Related Identifiers

CVE-2025-34414
DOTNETREMOTINGCHECK

Affected Products

Cardwizard
Entrust Instant Financial Issuance (Ifi) On Premise