The vulnerability arises from the SmartCardController service in Entrust Instant Financial Issuance that exposes a .NET Remoting channel with unsafe formatter settings, allowing unauthenticated callers to invoke remote objects. An attacker can read arbitrary files, force outbound authentication, and potentially write files or execute code, leading to disclosure of installation secrets and complete compromise of the affected host. The weakness is reflected in CWE-306 for improper authentication and CWE-502 for deserialization of untrusted data.

The affected software is Entrust Corporation's Instant Financial Issuance (IF) On-Premise product, including all 5.x releases, and 6.x releases prior to 6.10.5 and prior to 6.11.1. The vulnerable component is DCG.SmartCardControllerService.exe, which registers a TCP remoting channel.

The CVSS v3.1 base score of 9.3 indicates critical severity. The EPSS score of less than 1% suggests a very low probability of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. Nonetheless, the attack vector is network-based: an unauthenticated remote actor must be able to reach the remoting port to trigger the exploit, which could be mitigated by firewall rules. The involvement of unsafe serialization and lack of authentication allows for remote code execution once access is established.