BaseFortify

Publication date: 2025-12-02

Last updated on: 2025-12-08

Assigner: MITRE

Description

Entrust nShield Connect XC, nShield 5c, and nShield HSMi through 13.6.11, or 13.7, allow a physically proximate attacker with elevated privileges to falsify tamper events by accessing internal components.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-12-02

Last Modified

2025-12-08

Generated

2026-07-06

AI Q&A

2025-12-02

EPSS Evaluated

2026-07-05

NVD

CVE-2025-59702

EUVD

EUVD-2025-200252

Affected Vendors & Products

Vendor	Product	Version / Range
entrust	nshield_5c_firmware	From 13.7 (inc) to 13.9.0 (inc)
entrust	nshield_5c	*
entrust	nshield_hsmi	*
entrust	nshield_connect_xc_base_firmware	From 13.7 (inc) to 13.9.0 (inc)
entrust	nshield_connect_xc_base	*
entrust	nshield_connect_xc_mid_firmware	From 13.7 (inc) to 13.9.0 (inc)
entrust	nshield_connect_xc_mid	*
entrust	nshield_connect_xc_high_firmware	From 13.7 (inc) to 13.9.0 (inc)
entrust	nshield_connect_xc_high_firmware	From 13.7 (inc) to 13.9.0 (inc)
entrust	nshield_connect_xc_high	*
entrust	nshield_5c_firmware	From 13.7 (inc) to 13.9.0 (inc)
entrust	nshield_connect_xc_mid_firmware	From 13.7 (inc) to 13.9.0 (inc)
entrust	nshield_hsmi_firmware	From 13.7 (inc) to 13.9.0 (inc)
entrust	nshield_hsmi_firmware	From 13.7 (inc) to 13.9.0 (inc)
entrust	nshield_connect_xc_base_firmware	From 13.7 (inc) to 13.9.0 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-284	The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
CWE-203	The product behaves differently or sends different responses under different circumstances in a way that is observable to an unauthorized actor, which exposes security-relevant information about the state of the product, such as whether a particular operation was successful or not.

Attack-Flow Graph

Executive Summary

This vulnerability affects Entrust nShield Connect XC, nShield 5c, and nShield HSMi devices up to versions 13.6.11 and 13.7. It allows an attacker who is physically close to the device and has elevated privileges to falsify tamper events by accessing the internal components of the device.

Impact Analysis

The vulnerability could allow an attacker with physical access and elevated privileges to manipulate tamper event logs or signals, potentially hiding unauthorized access or tampering with the device. This could undermine the security and trustworthiness of the hardware security module.

Hi! I’m here to help you understand CVE-2025-59702. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70