CVE-2025-59694: Medium severity Entrust nShield Connect XC vulnerability
The Chassis Management Board in Entrust nShield Connect XC, nShield 5c, and nShield HSMi through 13.6.11, or 13.7 (patched in 13.6.12 (LTS) and 13.9.0 (STS)), allows a physically proximate attacker to persistently modify firmware and influence the (insecurely configured) appliance boot process. To exploit this, the attacker must modify the firmware via JTAG or perform an upgrade to the chassis management board firmware. This is called F03.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Entrust nShield Chassis Management Board firmware (nShield Connect XC / nShield 5c / nShield HSMi)to a version that resolves this vulnerability.Fixed in 13.6.12 - Upgrade
Upgrade
Entrust nShield Chassis Management Board firmware (nShield Connect XC / nShield 5c / nShield HSMi)to a version that resolves this vulnerability.Fixed in 13.9.0 - Compensating control
Mitigate physically proximate attackers by preventing access to JTAG interfaces and restricting physical access to the appliance/chassis management board to reduce the ability to modify chassis management board firmware.
Event History
Frequently Asked Questions
What is the severity of CVE-2025-59694?
CVE-2025-59694 is considered a high-severity vulnerability due to the potential for unauthorized firmware modification.
How do I fix CVE-2025-59694?
To address CVE-2025-59694, ensure that firmware is regularly updated and monitor physical access to affected appliances.
What products are affected by CVE-2025-59694?
CVE-2025-59694 affects Entrust nShield Connect XC, nShield 5c, and nShield HSMi appliances running versions up to 13.6.11.
Can CVE-2025-59694 be exploited remotely?
CVE-2025-59694 requires physical proximity to exploit, making remote exploitation unlikely.
What are the implications of CVE-2025-59694 on data security?
The vulnerability could allow an attacker to compromise the boot process, potentially leading to unauthorized access to sensitive data.