CVE-2025-59693: Entrust nShield Chassis Management Board privilege escalation via physical access

CVE-2025-59693 · Severity: critical · CVSS 9.8 · Published 2025-12-02

Entrust nShield HSM (Hardware Security Module) devices store and protect cryptographic keys and perform security operations for enterprises. An attacker with physical access can bypass tamper detection, open the chassis undetectably, and access the JTAG connector to gain debug access and escalate privileges, potentially exposing protected cryptographic material and enabling persistent compromise of the device.

Technologies: Entrust nShield Connect XC, Entrust Nshield 5c, Entrust Nshield Hsmi. Vendors: Entrust.

Quick answers

Is CVE-2025-59693 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2025-59693 being exploited in the wild.
How severe is CVE-2025-59693?
Critical severity, with a CVSS score of 9.8, published 2 December 2025.
Which products and versions are affected?
Entrust nShield Connect XC through 13.6.11, or 13.7 (patched in 13.6.12 LTS and 13.9.0 STS); Entrust Nshield 5c through 13.6.11, or 13.7 (patched in 13.6.12 LTS and 13.9.0 STS); Entrust Nshield Hsmi through 13.6.11, or 13.7 (patched in 13.6.12 LTS and 13.9.0 STS).
Is there a fix for CVE-2025-59693?
A patch was published on 2025-09-22: Patches available in version 13.6.12 (LTS) and 13.9.0 (STS) Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-59693 attacked?
It is attacked with physical access, in a network appliance.
Am I affected by CVE-2025-59693?
Check whether you run Entrust nShield Connect XC, Entrust Nshield 5c or Entrust Nshield Hsmi at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

This vulnerability (F02) is a hardware-level privilege escalation via JTAG access in the Chassis Management Board (Cosmo SoC) found in nShield HSM devices. The root cause is the lack of JTAG security protections and the absence of secure boot mechanisms on the ARM SoC; an attacker with physical access can open the chassis by bypassing the tamper label without leaving evidence, locate the exposed JTAG header, and use standard JTAG tools to read/modify firmware and access internal memory (flash, SRAM). Preconditions include physical proximity to the device. An attacker can then modify the Cosmo firmware persistently, disable tamper protections, control boot processes, and maintain undetectable persistence. Patches are available in version 13.6.12 (LTS) and 13.9.0 (STS).

Affected products

  • Entrust nShield Connect XC through 13.6.11, or 13.7 (patched in 13.6.12 LTS and 13.9.0 STS)
  • Entrust nShield 5c through 13.6.11, or 13.7 (patched in 13.6.12 LTS and 13.9.0 STS)
  • Entrust nShield HSMi through 13.6.11, or 13.7 (patched in 13.6.12 LTS and 13.9.0 STS)

Timeline

  • 2025-12-02: disclosed
  • 2025-09-22: patched: Patches available in version 13.6.12 (LTS) and 13.9.0 (STS)

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.