CVE-2025-59696: Entrust nShield Connect XC tamper event modification via chassis management

CVE-2025-59696 · Severity: low · CVSS 3.2 · Published 2025-12-02

Entrust nShield hardware security modules (HSMs) are appliances that generate and protect cryptographic keys for enterprise use. An attacker with physical access to an HSM can modify or erase its tamper event logs through the chassis management board, allowing them to hide evidence of intrusions or physical tampering without triggering security alerts.

Technologies: Entrust nShield Connect XC, Entrust Nshield 5c, Entrust Nshield Hsmi. Vendors: Entrust.

Quick answers

Is CVE-2025-59696 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2025-59696 being exploited in the wild.
How severe is CVE-2025-59696?
Low severity, with a CVSS score of 3.2, published 2 December 2025.
Which products and versions are affected?
Entrust nShield Connect XC through 13.6.11; 13.7 (patched in 13.6.12 LTS and 13.9.0 STS); Entrust Nshield 5c through 13.6.11; 13.7 (patched in 13.6.12 LTS and 13.9.0 STS); Entrust Nshield Hsmi through 13.6.11; 13.7 (patched in 13.6.12 LTS and 13.9.0 STS).
Is there a fix for CVE-2025-59696?
A patch was published on 2025-12-02: Patches available in nShield 13.6.12 (LTS) and 13.9.0 (STS) Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-59696 attacked?
It is attacked with physical access.
Am I affected by CVE-2025-59696?
Check whether you run Entrust nShield Connect XC, Entrust Nshield 5c or Entrust Nshield Hsmi at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

This vulnerability (CVE-2025-59696) stems from inadequate physical access controls on the Cosmo management board—specifically, the unencrypted, unprotected tamper event log stored on an I2C EEPROM. An attacker with physical access can read or modify the tamper log contents directly via JTAG (as described in CVE-2025-59693) or through root access on the Cosmo board. The log is stored in plaintext without authentication, signature, or encryption protections. The vulnerability requires low privilege and physical proximity; no user interaction is needed. An attacker can thus cover tracks of physical intrusion, firmware modification, or chassis opening. Patches are available in versions 13.6.12 (LTS) and 13.9.0 (STS).

Affected products

  • Entrust nShield Connect XC through 13.6.11; 13.7 (patched in 13.6.12 LTS and 13.9.0 STS)
  • Entrust nShield 5c through 13.6.11; 13.7 (patched in 13.6.12 LTS and 13.9.0 STS)
  • Entrust nShield HSMi through 13.6.11; 13.7 (patched in 13.6.12 LTS and 13.9.0 STS)

Timeline

  • 2025-09-22: disclosed: Initial disclosure of multiple nShield vulnerabilities including tamper event modification (CVE-2025-59696)
  • 2025-12-02: advisory: CVE-2025-59696 published to NVD
  • 2025-12-02: patched: Patches available in nShield 13.6.12 (LTS) and 13.9.0 (STS)

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.