Entrust nShield Connect XC/nShield 5c/nShield HSMi up to 13.6.11/13.7 Chassis Management Board improper access control for volatile memory containing boot code

Summaryinfo

A vulnerability categorized as critical has been discovered in Entrust nShield Connect XC, nShield 5c and nShield HSMi up to 13.6.11/13.7. The affected element is an unknown function of the component Chassis Management Board. Such manipulation leads to Local Privilege Escalation. This vulnerability is documented as CVE-2025-59694. The attack can be executed directly on the physical device. There is not any exploit available.

Detailsinfo

A vulnerability was found in Entrust nShield Connect XC, nShield 5c and nShield HSMi up to 13.6.11/13.7 and classified as critical. Affected by this issue is an unknown functionality of the component Chassis Management Board. The manipulation with an unknown input leads to a local privilege escalation vulnerability. Using CWE to declare the problem leads to CWE-1274. The product conducts a secure-boot process that transfers bootloader code from Non-Volatile Memory (NVM) into Volatile Memory (VM), but it does not have sufficient access control or other protections for the Volatile Memory. Impacted is confidentiality, integrity, and availability. CVE summarizes:

The Chassis Management Board in Entrust nShield Connect XC, nShield 5c, and nShield HSMi through 13.6.11, or 13.7, allows a physically proximate attacker to persistently modify firmware and influence the (insecurely configured) appliance boot process. To exploit this, the attacker must modify the firmware via JTAG or perform an upgrade to the chassis management board firmware. This is called F03.

The advisory is shared for download at entrust.com. This vulnerability is handled as CVE-2025-59694 since 09/18/2025. The exploitation is known to be easy. The attack needs to be approached locally. No form of authentication is required for exploitation. There are neither technical details nor an exploit publicly available.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• Entrust

Name

• nShield 5c
• nShield Connect XC
• nShield HSMi

Version

• 13.0
• 13.1
• 13.2
• 13.3
• 13.4
• 13.5
• 13.6
• 13.6.0
• 13.6.1
• 13.6.2
• 13.6.3
• 13.6.4
• 13.6.5
• 13.6.6
• 13.6.7
• 13.6.8
• 13.6.9
• 13.6.10
• 13.6.11
• 13.7

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion