CVE-2025-34414
📋 TL;DR
This vulnerability allows remote unauthenticated attackers to read arbitrary files, write files, and execute code on Entrust Instant Financial Issuance On Premise servers. The insecure .NET Remoting service is enabled by default, exposing sensitive endpoints. Affected systems include IFI On Premise versions 5.x, prior to 6.10.5, and prior to 6.11.1.
💻 Affected Systems
- Entrust Instant Financial Issuance On Premise (formerly CardWizard)
⚠️ Manual Verification Required
This CVE does not have specific version information in our database, so automatic vulnerability detection cannot determine if your system is affected.
Why? The CVE database entry doesn't specify which versions are vulnerable (no version ranges provided by the vendor/NVD).
🔒 Custom verification scripts are available for registered users. Sign up free to download automated test scripts.
- Review the CVE details at NVD
- Check vendor security advisories for your specific version
- Test if the vulnerability is exploitable in your environment
- Consider updating to the latest version as a precaution
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise via remote code execution leading to data theft, credential harvesting, and lateral movement within the network.
Likely Case
Unauthenticated attackers reading sensitive files containing installation data and service account credentials, potentially enabling further exploitation.
If Mitigated
Limited impact if network segmentation prevents access to the remoting port from untrusted networks.
🎯 Exploit Status
Exploitation uses known .NET Remoting techniques against exposed endpoints like logfile.rem and photo.rem. No authentication required.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 6.10.5 or 6.11.1
Vendor Advisory: https://trustedcare.entrust.com/s/article/E25-008-NET-Remoting-Vulnerabilities-in-Instant-Financial-Issuance-On-Premise-Software
Restart Required: Yes
Instructions:
1. Download the patched version (6.10.5 or 6.11.1) from Entrust. 2. Backup current installation. 3. Install the update following vendor documentation. 4. Restart the IFI service and verify functionality.
🔧 Temporary Workarounds
Disable Legacy Remoting Service
windowsDisable the vulnerable .NET Remoting service if not required for functionality.
Stop and disable the Legacy Remoting Service via Windows Services (services.msc) or using PowerShell: Stop-Service -Name 'Entrust IFI Legacy Remoting' -Force; Set-Service -Name 'Entrust IFI Legacy Remoting' -StartupType Disabled
Network Segmentation
windowsRestrict network access to the remoting port using firewall rules.
Windows Firewall: New-NetFirewallRule -DisplayName 'Block IFI Remoting Port' -Direction Inbound -LocalPort <remoting_port> -Protocol TCP -Action Block
Replace <remoting_port> with actual port number
🧯 If You Can't Patch
- Implement strict network segmentation to isolate the IFI server from untrusted networks and internal systems.
- Monitor network traffic to the remoting port for suspicious activity and implement intrusion detection rules.
🔍 How to Verify
Check if Vulnerable:
Check IFI version via Control Panel > Programs and Features or using PowerShell: Get-WmiObject -Class Win32_Product | Where-Object {$_.Name -like '*Entrust Instant Financial Issuance*'} | Select-Object Name, VersionCheck Version:
Get-WmiObject -Class Win32_Product | Where-Object {$_.Name -like '*Entrust Instant Financial Issuance*'} | Select-Object Name, VersionVerify Fix Applied:
Verify version is 6.10.5 or 6.11.1 using the same version check command and ensure the Legacy Remoting Service is disabled or patched.📡 Detection & Monitoring
Log Indicators:
- Unusual access to logfile.rem, photo.rem, cwPhoto.rem, or reports.rem endpoints in application logs
- Failed authentication attempts or unexpected outbound authentication from the IFI server
Network Indicators:
- TCP connections to the IFI remoting port from unexpected IP addresses
- SOAP or binary .NET Remoting traffic to the vulnerable endpoints
SIEM Query:
source="IFI_Logs" AND (endpoint="logfile.rem" OR endpoint="photo.rem" OR endpoint="cwPhoto.rem" OR endpoint="reports.rem") AND src_ip NOT IN [trusted_ips]🔗 References
- https://trustedcare.entrust.com/s/article/E25-008-NET-Remoting-Vulnerabilities-in-Instant-Financial-Issuance-On-Premise-Software
- https://www.entrust.com/products/issuance-systems/instant/financial-card
- https://www.vulncheck.com/advisories/entrust-ifi-legacy-remoting-unauthenticated-net-remoting-exposure
