CVE-2025-59695
BaseFortify
Publication date: 2025-12-02
Last updated on: 2025-12-15
Assigner: MITRE
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| entrust | nshield_5c_firmware | to 13.6.12 (exc) |
| entrust | nshield_5c_firmware | From 13.7.3 (inc) to 13.9.0 (exc) |
| entrust | nshield_5c | * |
| entrust | nshield_hsmi_firmware | to 13.6.12 (exc) |
| entrust | nshield_hsmi_firmware | From 13.7.3 (inc) to 13.9.0 (exc) |
| entrust | nshield_hsmi | * |
| entrust | nshield_connect_xc_base_firmware | to 13.6.12 (exc) |
| entrust | nshield_connect_xc_base_firmware | From 13.7.3 (inc) to 13.9.0 (exc) |
| entrust | nshield_connect_xc_base | * |
| entrust | nshield_connect_xc_mid_firmware | to 13.6.12 (exc) |
| entrust | nshield_connect_xc_mid_firmware | From 13.7.3 (inc) to 13.9.0 (exc) |
| entrust | nshield_connect_xc_mid | * |
| entrust | nshield_connect_xc_high_firmware | to 13.6.12 (exc) |
| entrust | nshield_connect_xc_high_firmware | From 13.7.3 (inc) to 13.9.0 (exc) |
| entrust | nshield_connect_xc_high | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-306 | The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability affects Entrust nShield Connect XC, nShield 5c, and nShield HSMi devices up to versions 13.6.11 and 13.7. It allows a user who already has operating system root access to alter the firmware on the Chassis Management Board without requiring any authentication. This vulnerability is identified as F04.
How can this vulnerability impact me? :
If an attacker gains OS root access, they can modify the firmware on the Chassis Management Board without authentication. This could lead to unauthorized changes to the device's hardware management, potentially compromising the security and integrity of the system.