Is CVE-2025-59701 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-59701 being exploited in the wild.

How severe is CVE-2025-59701?

Medium severity, with a CVSS score of 4.1, published 2 December 2025.

Which products and versions are affected?

Entrust nShield Connect XC through 13.6.11, 13.7 (patched in 13.6.12, 13.9.0); Entrust Nshield 5c through 13.6.11, 13.7 (patched in 13.6.12, 13.9.0); Entrust Nshield Hsmi through 13.6.11, 13.7 (patched in 13.6.12, 13.9.0).

Is there a fix for CVE-2025-59701?

A patch was published on 2025-09-22: Patches available in version 13.6.12 (LTS) and 13.9.0 (STS) Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2025-59701 attacked?

It is attacked with physical access.

Am I affected by CVE-2025-59701?

Check whether you run Entrust nShield Connect XC, Entrust Nshield 5c or Entrust Nshield Hsmi at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-59701: Entrust nShield unencrypted SSD storage access

CVE-2025-59701 · Severity: medium · CVSS 4.1 · Published 2025-12-02

Entrust nShield hardware security modules (HSMs) are appliances used to store and manage cryptographic keys for organizations. A physically proximate attacker with elevated privileges can directly access and modify the unencrypted SSD, potentially exposing or tampering with sensitive key material and system data stored on the device.

Technologies: Entrust nShield Connect XC, Entrust Nshield 5c, Entrust Nshield Hsmi. Vendors: Entrust.

Quick answers

Is CVE-2025-59701 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-59701 being exploited in the wild.
How severe is CVE-2025-59701?: Medium severity, with a CVSS score of 4.1, published 2 December 2025.
Which products and versions are affected?: Entrust nShield Connect XC through 13.6.11, 13.7 (patched in 13.6.12, 13.9.0); Entrust Nshield 5c through 13.6.11, 13.7 (patched in 13.6.12, 13.9.0); Entrust Nshield Hsmi through 13.6.11, 13.7 (patched in 13.6.12, 13.9.0).
Is there a fix for CVE-2025-59701?: A patch was published on 2025-09-22: Patches available in version 13.6.12 (LTS) and 13.9.0 (STS) Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-59701 attacked?: It is attacked with physical access.
Am I affected by CVE-2025-59701?: Check whether you run Entrust nShield Connect XC, Entrust Nshield 5c or Entrust Nshield Hsmi at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

This vulnerability is a cleartext storage issue (CWE-312) affecting the Appliance SSD in nShield HSMs. The SSD contents are stored unencrypted, allowing an attacker with physical access and elevated privileges to read and modify the storage directly. The attack requires physical proximity and elevated privileges on the device. An attacker can extract sensitive key material, configuration data, or inject malicious modifications. Patches are available in version 13.6.12 (LTS) and 13.9.0 (STS); affected versions include 13.6.11 and earlier, and 13.7.

Affected products

Entrust nShield Connect XC through 13.6.11, 13.7 (patched in 13.6.12, 13.9.0)
Entrust nShield 5c through 13.6.11, 13.7 (patched in 13.6.12, 13.9.0)
Entrust nShield HSMi through 13.6.11, 13.7 (patched in 13.6.12, 13.9.0)

Timeline

2025-12-02: disclosed
2025-09-22: patched: Patches available in version 13.6.12 (LTS) and 13.9.0 (STS)

References

https://github.com/google/security-research/security/advisories/GHSA-6q4x-m86j-gfwj

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.