CVE-2025-59700: Entrust nShield HSM recovery partition integrity vulnerability

CVE-2025-59700 · Severity: low · CVSS 3.9 · Published 2025-12-02

Entrust nShield HSMs are security appliances that protect and manage cryptographic keys for enterprises. A physically proximate attacker with root access can modify the device's Recovery Partition without detection due to missing integrity verification. While this requires both physical proximity and root privileges, successful exploitation could allow persistent, undetectable compromise of the HSM and the keys it protects.

Technologies: Entrust nShield Connect XC, Entrust Nshield 5c, Entrust Nshield Hsmi. Vendors: Entrust.

Quick answers

Is CVE-2025-59700 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2025-59700 being exploited in the wild.
How severe is CVE-2025-59700?
Low severity, with a CVSS score of 3.9, published 2 December 2025.
Which products and versions are affected?
Entrust nShield Connect XC through 13.6.11 or 13.7; patched in 13.6.12 (LTS) and 13.9.0 (STS); Entrust Nshield 5c through 13.6.11 or 13.7; patched in 13.6.12 (LTS) and 13.9.0 (STS); Entrust Nshield Hsmi through 13.6.11 or 13.7; patched in 13.6.12 (LTS) and 13.9.0 (STS).
Is there a fix for CVE-2025-59700?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2025-59700 attacked?
It is attacked with physical access, in a network appliance.
Am I affected by CVE-2025-59700?
Check whether you run Entrust nShield Connect XC, Entrust Nshield 5c or Entrust Nshield Hsmi at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

This vulnerability stems from insufficient verification of data authenticity (CWE-345) in the Recovery Partition of nShield HSM appliances. The Recovery Partition lacks integrity protection mechanisms, allowing an attacker with root access and physical proximity to modify its contents without detection. The attack vector is physical with high privilege requirements (root access). Successful exploitation enables persistent and undetectable modification of the Recovery Partition, potentially leading to compromised key management operations. Patches are available: version 13.6.12 (LTS) and 13.9.0 (STS) address this issue.

Affected products

  • Entrust nShield Connect XC through 13.6.11 or 13.7; patched in 13.6.12 (LTS) and 13.9.0 (STS)
  • Entrust nShield 5c through 13.6.11 or 13.7; patched in 13.6.12 (LTS) and 13.9.0 (STS)
  • Entrust nShield HSMi through 13.6.11 or 13.7; patched in 13.6.12 (LTS) and 13.9.0 (STS)

Timeline

  • 2025-12-02: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.