Entrust Instant Financial Issuance up to 5.x/6.10.4/6.11.0 SmartCardController Service DCG.SmartCardControllerService.exe missing authentication

Summaryinfo

A vulnerability was found in Entrust Instant Financial Issuance up to 5.x/6.10.4/6.11.0 and classified as critical. Affected by this issue is some unknown functionality of the file DCG.SmartCardControllerService.exe of the component SmartCardController Service. Such manipulation leads to missing authentication. This vulnerability is listed as CVE-2026-23746. The attack may be performed from remote. There is no available exploit. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as very critical, has been found in Entrust Instant Financial Issuance up to 5.x/6.10.4/6.11.0. Affected by this issue is an unknown code of the file DCG.SmartCardControllerService.exe of the component SmartCardController Service. The manipulation with an unknown input leads to a missing authentication vulnerability. Using CWE to declare the problem leads to CWE-306. The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources. Impacted is confidentiality, integrity, and availability. CVE summarizes:

Entrust Instant Financial Issuance (IFI) On Premise software (formerly referred to as CardWizard) versions 5.x, prior to 6.10.5, and prior to 6.11.1 contain an insecure .NET Remoting exposure in the SmartCardController service (DCG.SmartCardControllerService.exe). The service registers a TCP remoting channel with unsafe formatter/settings that permit untrusted remoting object invocation. A remote, unauthenticated attacker who can reach the remoting port can invoke exposed remoting objects to read arbitrary files from the server and coerce outbound authentication, and may achieve arbitrary file write and remote code execution via known .NET Remoting exploitation techniques. This can lead to disclosure of sensitive installation and service-account data and compromise of the affected host.

The weakness was presented by Victor A. Morales. The advisory is shared for download at entrust.com. This vulnerability is handled as CVE-2026-23746 since 01/15/2026. The exploitation is known to be easy. The attack may be launched remotely. No form of authentication is required for exploitation. There are known technical details, but no exploit is available. The current price for an exploit might be approx. USD $0-$5k (estimation calculated on 01/15/2026).

Upgrading to version 6.10.5 or 6.11.1 eliminates this vulnerability.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Type

• Financial Software

Vendor

• Entrust

Name

• Instant Financial Issuance

Version

• 5.x
• 6.0
• 6.1
• 6.2
• 6.3
• 6.4
• 6.5
• 6.6
• 6.7
• 6.8
• 6.9
• 6.10
• 6.10.0
• 6.10.1
• 6.10.2
• 6.10.3
• 6.10.4
• 6.11.0

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion