CVE-2025-34414
BaseFortify
Publication date: 2025-12-09
Last updated on: 2025-12-09
Assigner: VulnCheck
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| entrust | instant_financial_issuance | 6.10.5 |
| entrust | instant_financial_issuance | 5.x |
| entrust | instant_financial_issuance | 6.11.1 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-306 | The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources. |
| CWE-502 | The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in Entrust Instant Financial Issuance (IFI) On Premise software versions 5.x prior to 6.10.5 and prior to 6.11.1. It involves an insecure .NET Remoting exposure in the Legacy Remoting Service, which is enabled by default. The service registers a TCP remoting channel with SOAP and binary formatters configured at TypeFilterLevel=Full and exposes default ObjectURI endpoints. A remote, unauthenticated attacker who can access the remoting port can invoke exposed remoting objects to read arbitrary files from the server, coerce outbound authentication, and potentially achieve arbitrary file write and remote code execution using known .NET Remoting exploitation techniques. This can lead to disclosure of sensitive installation and service-account data and compromise of the affected host.
How can this vulnerability impact me? :
This vulnerability can allow a remote, unauthenticated attacker to read arbitrary files on the server, coerce outbound authentication, and potentially write files or execute code remotely on the affected host. This can lead to disclosure of sensitive installation and service-account data and full compromise of the affected system.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability allows remote, unauthenticated attackers to read arbitrary files, disclose sensitive installation and service-account data, and potentially execute arbitrary code on the affected host. Such unauthorized disclosure and compromise of sensitive data can lead to non-compliance with common standards and regulations like GDPR and HIPAA, which require protection of sensitive and personal data against unauthorized access and breaches. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
Detection involves identifying if the Legacy Remoting Service is running and exposing the .NET Remoting TCP channel with SOAP and binary formatters at TypeFilterLevel=Full and default ObjectURI endpoints. You can scan your network for open TCP ports associated with the remoting service (commonly the configured remoting port). For example, use network scanning tools like nmap to detect open remoting ports: nmap -p <remoting_port> <target_ip>. Additionally, inspecting running services on the host for Entrust IFI versions prior to 6.10.5 or 6.11.1 and checking for .NET Remoting endpoints can help. Specific commands depend on your environment, but checking listening ports (e.g., netstat -an | findstr <port>) and reviewing service configurations for .NET Remoting usage are recommended. [1]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include upgrading Entrust Instant Financial Issuance (IFI) On Premise software to version 6.10.5 or later, or 6.11.1 or later, where the insecure .NET Remoting exposure is fixed. If upgrading is not immediately possible, restrict network access to the remoting port by firewalling or network segmentation to prevent unauthenticated remote access. Additionally, disable the Legacy Remoting Service if it is not required. These steps reduce the attack surface and prevent exploitation of the insecure remoting channel. [1]