CVE-2025-59702: Entrust nShield HSM tamper event falsification via physical access

CVE-2025-59702 · Severity: high · CVSS 7.2 · Published 2025-12-02

Entrust's nShield HSM appliances are used to protect cryptographic keys and secure operations for financial institutions and enterprises. A physically proximate attacker with elevated privileges can falsify or erase tamper event logs by accessing internal hardware components without triggering security alarms, potentially hiding unauthorized access or modifications to the device.

Technologies: Entrust nShield Connect XC, Entrust Nshield 5c, Entrust Nshield Hsmi. Vendors: Entrust.

Quick answers

Is CVE-2025-59702 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2025-59702 being exploited in the wild.
How severe is CVE-2025-59702?
High severity, with a CVSS score of 7.2, published 2 December 2025.
Which products and versions are affected?
Entrust nShield Connect XC through 13.6.11; patched in 13.6.12 (LTS) and 13.9.0 (STS); Entrust Nshield 5c through 13.6.11; patched in 13.6.12 (LTS) and 13.9.0 (STS); Entrust Nshield Hsmi through 13.6.11, or 13.7; patched in 13.6.12 (LTS) and 13.9.0 (STS).
Is there a fix for CVE-2025-59702?
A patch was published on 2025-09-22: Patches available in versions 13.6.12 (LTS) and 13.9.0 (STS) Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-59702 attacked?
It is attacked with physical access.
Am I affected by CVE-2025-59702?
Check whether you run Entrust nShield Connect XC, Entrust Nshield 5c or Entrust Nshield Hsmi at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

This vulnerability (CWE-203: Observable Discrepancy) allows an attacker with physical access and elevated privileges to modify the unencrypted tamper event log stored on an I2C EEPROM on the Cosmo board. An attacker can access the JTAG connector on the device or use root access via firmware upgrades to edit or clear the tamper log without detection. The vulnerability requires physical proximity and elevated privileges but poses a critical integrity risk, as it enables persistent, undetectable modification of security logs that are meant to alert operators to tampering. Patches are available in versions 13.6.12 (LTS) and 13.9.0 (STS).

Affected products

  • Entrust nShield Connect XC through 13.6.11; patched in 13.6.12 (LTS) and 13.9.0 (STS)
  • Entrust nShield 5c through 13.6.11; patched in 13.6.12 (LTS) and 13.9.0 (STS)
  • Entrust nShield HSMi through 13.6.11, or 13.7; patched in 13.6.12 (LTS) and 13.9.0 (STS)

Timeline

  • 2025-12-02: disclosed
  • 2025-09-22: patched: Patches available in versions 13.6.12 (LTS) and 13.9.0 (STS)

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.