Entrust Instant Financial Issuance

Submit a proposal Propose CVE/GCVE/GHSA reference

Approved changes feed: RSS · Atom

cpe:2.3:a:entrust_instant_financial_issuance:entrust_instant_financial_issuance:*:*:*:*:*:*:*:*

part: a version: * update: *

VendorEntrust Instant Financial Issuance (d06096b7-2c3d-5f0d-941f-edae6bacc6dc)
ProductEntrust Instant Financial Issuance (1f62356c-50dc-5a7b-a18f-064dcdbddcd4)
Edition*
Language*
Software edition*
Target software*
Target hardware*
Other*

Notes

Imported from gcve-enriched-dumps CVE data

PURL mappings

PURLSourceLast updated
No PURL mappings for this CPE yet.

Vulnerability references

IdentifiercpeApplicabilitySubmitteddb.gcve.eu detailsRationale
CVE:CVE-2024-39342 vulnerable 2026-06-08 06:41:49.099078 Details available
Entrust Instant Financial Issuance (formerly known as Cardwizard) 6.10.0, 6.9.0, 6.9.1, 6.9.2, and 6.8.x and earlier uses a DLL library (i.e. DCG.Security.dll) with a custom AES encryption process that relies on static hard-coded key values. These keys are not uniquely generated per installation of the software. Combined with the encrypted password that can be obtained from "WebAPI.cfg.xml" in CVE-2024-39341, the decryption is trivial and can lead to privilege escalation on the Windows host.
Published: 2024-09-23T00:00:00.000Z
Updated: 2024-09-23T19:46:54.760Z
Reference links
Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.

Inspect record JSON

Open JSON directly

Open this panel to browse, search, copy or download the JSON record.