Entrust Instant Financial Issuance up to 5.x/6.10.4/6.11.0 Legacy Remoting Service deserialization

Summaryinfo

A vulnerability identified as very critical has been detected in Entrust Instant Financial Issuance up to 5.x/6.10.4/6.11.0. The impacted element is an unknown function of the component Legacy Remoting Service. Performing a manipulation results in deserialization. This vulnerability was named CVE-2025-34414. The attack may be initiated remotely. There is no available exploit. You should upgrade the affected component.

Detailsinfo

A vulnerability was found in Entrust Instant Financial Issuance up to 5.x/6.10.4/6.11.0. It has been classified as very critical. This affects some unknown functionality of the component Legacy Remoting Service. The manipulation with an unknown input leads to a deserialization vulnerability. CWE is classifying the issue as CWE-502. The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

Entrust Instant Financial Issuance (IFI) On Premise software (formerly referred to as CardWizard) versions 5.x, prior to 6.10.5, and prior to 6.11.1 contain an insecure .NET Remoting exposure in the Legacy Remoting Service that is enabled by default. The service registers a TCP remoting channel with SOAP and binary formatters configured at TypeFilterLevel=Full and exposes default ObjectURI endpoints such as logfile.rem, photo.rem, cwPhoto.rem, and reports.rem on a network-reachable remoting port. A remote, unauthenticated attacker who can reach the remoting port can invoke exposed remoting objects to read arbitrary files from the server and coerce outbound authentication, and may achieve arbitrary file write and remote code execution via known .NET Remoting exploitation techniques. This can lead to disclosure of sensitive installation and service-account data and compromise of the affected host.

The weakness was presented by Victor A. Morales. It is possible to read the advisory at entrust.com. This vulnerability is uniquely identified as CVE-2025-34414 since 04/15/2025. The exploitability is told to be easy. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. The technical details are unknown and an exploit is not publicly available. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 01/15/2026).

Upgrading to version 6.10.5 or 6.11.1 eliminates this vulnerability.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• Financial Software

Vendor

• Entrust

Name

• Instant Financial Issuance

Version

• 5.x
• 6.0
• 6.1
• 6.2
• 6.3
• 6.4
• 6.5
• 6.6
• 6.7
• 6.8
• 6.9
• 6.10
• 6.10.0
• 6.10.1
• 6.10.2
• 6.10.3
• 6.10.4
• 6.11.0

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion