CVE-2025-59701
MediumCVSS 4.1Exploitation Probability (EPSS)
Low risk6th percentile - higher than 6% of all known CVEs
Summary
Entrust nShield Connect XC, nShield 5c, and nShield HSMi through 13.6.11, or 13.7 (patched in 13.6.12 (LTS) and 13.9.0 (STS)), allow a physically proximate attacker (with elevated privileges) to read and modify the Appliance SSD contents (because they are unencrypted).
Risk Assessment
The risk includes compromise of confidentiality and integrity of data stored on the HSM appliance, potentially leading to exposure of cryptographic keys and other sensitive information. An attacker with physical access could also manipulate device configuration.
Recommendation
Update the appliance firmware to version 13.6.12 (LTS) or 13.9.0 (STS) or later. Also restrict physical access to the devices and consider additional physical security measures.
Other vulnerabilities in Entrust nShield
See all- CVE-2025-59703Critical
Entrust nShield Connect XC, nShield 5c, and nShield HSMi through 13.6.11 or 13.7 (patched in 13.6.12 LTS and 13.9.0 STS) allow a physically proximate attacker to access internal components of the appliance without leaving tamper evidence. To exploit this, the attacker needs to remove the tamper label and all fixing screws without damaging the device. This is called an F14 attack.
- CVE-2025-59695Critical
Entrust nShield Connect XC, nShield 5c, and nShield HSMi through 13.6.11 or 13.7 (patched in 13.6.12 LTS and 13.9.0 STS) allow a user with OS root access to alter firmware on the Chassis Management Board without authentication. This is called F04.
- CVE-2025-59693Critical
The Chassis Management Board in Entrust nShield Connect XC, nShield 5c, and nShield HSMi through 13.6.11 or 13.7 (patched in 13.6.12 LTS and 13.9.0 STS) allows a physically proximate attacker to obtain debug access and escalate privileges by bypassing the tamper label and opening the chassis without leaving evidence, and accessing the JTAG connector. This is called F02.
- CVE-2025-59704Medium
A vulnerability in Entrust nShield Connect XC, nShield 5c, and nShield HSMi devices (up to 13.6.11 or 13.7) allows an attacker to gain access to the BIOS menu because it has no password.
- CVE-2025-59705Medium
A vulnerability in Entrust nShield Connect XC, nShield 5c, and nShield HSMi devices (up to 13.6.11 or 13.7) allows a physically proximate attacker to escalate privileges by inserting a probe into the chassis during system boot, enabling the USB interface. This is fixed in versions 13.6.12 (LTS) and 13.9.0 (STS).
- CVE-2025-59702High
Entrust nShield Connect XC, nShield 5c, and nShield HSMi through 13.6.11, or 13.7 (patched in 13.6.12 (LTS) and 13.9.0 (STS)), allow a physically proximate attacker with elevated privileges to falsify tamper events by accessing internal components.
- CVE-2025-59700Low
Entrust nShield Connect XC, nShield 5c, and nShield HSMi through 13.6.11, or 13.7 (patched in 13.6.12 (LTS) and 13.9.0 (STS)), allow a physically proximate attacker with root access to modify the Recovery Partition (because of a lack of integrity protection).
- CVE-2025-59699Medium
A vulnerability in Entrust nShield Connect XC, nShield 5c, and nShield HSMi devices (up to 13.6.11 or 13.7) allows a physically proximate attacker to escalate privileges by booting from a USB device with a valid root filesystem. This occurs due to insecure default settings in the Legacy GRUB Bootloader.
- CVE-2025-59698Medium
A vulnerability in Entrust nShield Connect XC, nShield 5c, and nShield HSMi devices (up to 13.6.11 or 13.7) might allow a physically proximate attacker to gain access to the EOL legacy bootloader.
- CVE-2025-59697High
Entrust nShield Connect XC, nShield 5c, and nShield HSMi through 13.6.11, or 13.7 (patched in 13.6.12 (LTS) and 13.9.0 (STS)), allow a physically proximate attacker to escalate privileges by editing the Legacy GRUB bootloader configuration to start a root shell upon boot of the host OS. This is called F06.
Original NVD description (English source)
Entrust nShield Connect XC, nShield 5c, and nShield HSMi through 13.6.11, or 13.7 (patched in 13.6.12 (LTS) and 13.9.0 (STS)), allow a physically proximate attacker (with elevated privileges) to read and modify the Appliance SSD contents (because they are unencrypted).