CVE-2025-59702
BaseFortify
Publication date: 2025-12-02
Last updated on: 2025-12-08
Assigner: MITRE
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| entrust | nshield_5c_firmware | From 13.7 (inc) to 13.9.0 (inc) |
| entrust | nshield_5c | * |
| entrust | nshield_hsmi | * |
| entrust | nshield_connect_xc_base_firmware | From 13.7 (inc) to 13.9.0 (inc) |
| entrust | nshield_connect_xc_base | * |
| entrust | nshield_connect_xc_mid_firmware | From 13.7 (inc) to 13.9.0 (inc) |
| entrust | nshield_connect_xc_mid | * |
| entrust | nshield_connect_xc_high_firmware | From 13.7 (inc) to 13.9.0 (inc) |
| entrust | nshield_connect_xc_high_firmware | From 13.7 (inc) to 13.9.0 (inc) |
| entrust | nshield_connect_xc_high | * |
| entrust | nshield_5c_firmware | From 13.7 (inc) to 13.9.0 (inc) |
| entrust | nshield_connect_xc_mid_firmware | From 13.7 (inc) to 13.9.0 (inc) |
| entrust | nshield_hsmi_firmware | From 13.7 (inc) to 13.9.0 (inc) |
| entrust | nshield_hsmi_firmware | From 13.7 (inc) to 13.9.0 (inc) |
| entrust | nshield_connect_xc_base_firmware | From 13.7 (inc) to 13.9.0 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-284 | The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor. |
| CWE-203 | The product behaves differently or sends different responses under different circumstances in a way that is observable to an unauthorized actor, which exposes security-relevant information about the state of the product, such as whether a particular operation was successful or not. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability affects Entrust nShield Connect XC, nShield 5c, and nShield HSMi devices up to versions 13.6.11 and 13.7. It allows an attacker who is physically close to the device and has elevated privileges to falsify tamper events by accessing the internal components of the device.
How can this vulnerability impact me? :
The vulnerability could allow an attacker with physical access and elevated privileges to manipulate tamper event logs or signals, potentially hiding unauthorized access or tampering with the device. This could undermine the security and trustworthiness of the hardware security module.