CVE-2024-34329: Entrust Datacard XPS Driver RCE Flaw

CVE-2024-34329 Overview

CVE-2024-34329 is an insecure permissions vulnerability in the Entrust Datacard XPS Card Printer Driver version 8.5 and earlier. The flaw exists in installations that lack the dxp1-patch-E24-004 patch. Attackers can place a crafted DLL payload in a directory writable by low-privilege users. The driver loads the malicious DLL and executes it in the context of the SYSTEM account. This weakness is classified under [CWE-277: Insecure Inherited Permissions]. The CVSS 3.1 score is 8.4, reflecting local attack vector requirements combined with full compromise of confidentiality, integrity, and availability.

Critical Impact
A local unauthenticated attacker can achieve arbitrary code execution as SYSTEM on any Windows host running the vulnerable Entrust Datacard XPS Card Printer Driver.

Affected Products

Entrust Datacard XPS Card Printer Driver 8.5
Entrust Datacard XPS Card Printer Driver versions earlier than 8.5
Installations missing the dxp1-patch-E24-004 update

Discovery Timeline

2024-07-22 - CVE-2024-34329 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-34329

Vulnerability Analysis

The Entrust Datacard XPS Card Printer Driver installs files and directories with permissive access control lists. Non-privileged users on the host retain write access to directories that the driver loads code from at runtime. Because the driver executes with SYSTEM privileges, any DLL placed into these directories runs with the highest local privilege level. This transforms a local low-privilege foothold into full host compromise without requiring credentials, user interaction, or authentication to the driver service.

Root Cause

The root cause is insecure inherited permissions on driver installation directories, mapped to [CWE-277]. During installation, the driver does not restrict the discretionary access control list (DACL) on its program directories to administrators and SYSTEM. Standard users inherit Modify or Write rights on paths that the privileged driver process references. This violates the Windows principle of least privilege for services running as NT AUTHORITY\SYSTEM.

Attack Vector

Exploitation requires local access to the target system but does not require valid credentials on the driver itself. An attacker writes a crafted DLL into the writable driver directory using the name of a legitimate library that the printer driver loads. When the driver process starts or reloads its components, Windows resolves the DLL from the attacker-controlled path and loads the payload into a SYSTEM process. The attacker then executes arbitrary commands, deploys persistence, or pivots to domain resources. Full technical steps are documented in the public proof-of-concept repository.

No verified exploit code is reproduced here. See the referenced
proof-of-concept repository for the technical walkthrough of the
DLL planting sequence against the vulnerable driver directory.

Detection Methods for CVE-2024-34329

Indicators of Compromise

Unexpected DLL files written to Entrust Datacard XPS Card Printer Driver installation directories by non-administrator accounts
Child processes such as cmd.exe, powershell.exe, or rundll32.exe spawned by the printer driver service running as SYSTEM
New scheduled tasks, services, or local accounts created immediately after driver process activity
Outbound network connections initiated from the printer driver process context

Detection Strategies

Audit DACLs on the Entrust Datacard driver installation path and alert when standard users hold Write or Modify rights
Monitor Sysmon Event ID 11 (FileCreate) for DLL writes into printer driver directories by non-privileged security identifiers
Correlate Sysmon Event ID 7 (ImageLoad) entries showing DLL loads from user-writable paths into SYSTEM processes

Monitoring Recommendations

Enable command-line and module-load logging on all endpoints that host Entrust card printer software
Baseline the legitimate module set for the driver process and alert on any deviation
Forward endpoint telemetry to a central data lake to enable retrospective hunting across the fleet

How to Mitigate CVE-2024-34329

Immediate Actions Required

Apply the dxp1-patch-E24-004 update from Entrust to all systems running the XPS Card Printer Driver
Inventory hosts with the vulnerable driver installed and prioritize patching on shared workstations and card issuance systems
Restrict local logon rights on card printing hosts to reduce the population of accounts that can stage a DLL

Patch Information

Entrust released patch dxp1-patch-E24-004 to address CVE-2024-34329. The patch corrects the directory permissions used by the XPS Card Printer Driver. Refer to the Entrust Security Bulletin E24-004 for the official remediation guidance. Driver downloads are available from the Entrust Driver Downloads portal and the Entrust DS3 Printer Support page.

Workarounds

Manually harden the DACL on the driver installation directory so only Administrators and SYSTEM retain write access
Remove the driver from hosts that do not require card printing functionality until the patch is applied
Enforce application control policies that block unsigned or unexpected DLLs from loading into privileged processes

bash

# Restrict the driver directory ACL to Administrators and SYSTEM (example)
icacls "C:\Program Files\Entrust\XPS Card Printer Driver" /inheritance:r
icacls "C:\Program Files\Entrust\XPS Card Printer Driver" /grant:r "Administrators:(OI)(CI)F" "SYSTEM:(OI)(CI)F"
icacls "C:\Program Files\Entrust\XPS Card Printer Driver" /remove "Users" "Authenticated Users"