CVE-2025-59693
BaseFortify
Publication date: 2025-12-02
Last updated on: 2025-12-15
Assigner: MITRE
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| entrust | nshield_5c_firmware | to 13.6.12 (exc) |
| entrust | nshield_5c_firmware | From 13.7.3 (inc) to 13.9.0 (exc) |
| entrust | nshield_5c | * |
| entrust | nshield_hsmi_firmware | to 13.6.12 (exc) |
| entrust | nshield_hsmi_firmware | From 13.7.3 (inc) to 13.9.0 (exc) |
| entrust | nshield_hsmi | * |
| entrust | nshield_connect_xc_base_firmware | to 13.6.12 (exc) |
| entrust | nshield_connect_xc_base_firmware | From 13.7.3 (inc) to 13.9.0 (exc) |
| entrust | nshield_connect_xc_base | * |
| entrust | nshield_connect_xc_mid_firmware | to 13.6.12 (exc) |
| entrust | nshield_connect_xc_mid_firmware | From 13.7.3 (inc) to 13.9.0 (exc) |
| entrust | nshield_connect_xc_mid | * |
| entrust | nshield_connect_xc_high_firmware | to 13.6.12 (exc) |
| entrust | nshield_connect_xc_high_firmware | From 13.7.3 (inc) to 13.9.0 (exc) |
| entrust | nshield_connect_xc_high | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-269 | The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability involves the Chassis Management Board in certain Entrust nShield devices, where a physically close attacker can bypass the tamper label and open the chassis without leaving evidence. By doing so, the attacker can gain debug access and escalate privileges by accessing the JTAG connector. This type of attack is referred to as F02.
How can this vulnerability impact me? :
The vulnerability allows an attacker with physical proximity to the device to gain unauthorized debug access and escalate privileges, potentially compromising the security of the device and any sensitive operations or data it protects.