# CVE-2025-59703: Entrust nShield HSM physical tamper bypass and firmware access

Source: https://junglewise.ai/threats/cve-2025-59703-entrust-nshield-hsm-physical-tamper-bypass-and-firmware-access  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-12-02. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2025-59703 · Severity: critical · CVSS 9.1 · Published 2025-12-02

Entrust nShield HSMs are cryptographic appliances used to secure and manage encryption keys for organizations. A physically proximate attacker can open these devices without triggering tamper detection, access internal components including firmware storage, and persistently modify the device to gain unauthorized access to protected cryptographic keys. This could allow an attacker to compromise the entire cryptographic infrastructure protected by the HSM.

Technologies: [Entrust nShield Connect XC](https://junglewise.ai/threats/technologies/nshield-connect-xc), [Entrust Nshield 5c](https://junglewise.ai/threats/technologies/nshield-5c), [Entrust Nshield Hsmi](https://junglewise.ai/threats/technologies/nshield-hsmi). Vendors: [Entrust](https://junglewise.ai/threats/vendors/entrust).

## Quick answers

**Is CVE-2025-59703 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-59703 being exploited in the wild.

**How severe is CVE-2025-59703?** Critical severity, with a CVSS score of 9.1, published 2 December 2025.

**Which products and versions are affected?** Entrust nShield Connect XC through 13.6.11 (patched in 13.6.12 LTS and 13.9.0 STS); Entrust Nshield 5c through 13.6.11 (patched in 13.6.12 LTS and 13.9.0 STS); Entrust Nshield Hsmi through 13.6.11, or 13.7 (patched in 13.6.12 LTS and 13.9.0 STS).

**Is there a fix for CVE-2025-59703?** A patch was published on 2025: Patch available in nShield 13.6.12 (LTS) and 13.9.0 (STS) Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2025-59703 attacked?** It is attacked with physical access, in a network appliance.

**Am I affected by CVE-2025-59703?** Check whether you run Entrust nShield Connect XC, Entrust Nshield 5c or Entrust Nshield Hsmi at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This vulnerability chain encompasses multiple physical and firmware-level attacks (F01–F05) on Entrust nShield HSM appliances. The root cause is inadequate physical tamper detection and lack of secure boot protections. An attacker can remove the tamper label and screws (F14 attack) without triggering events, then exploit multiple attack paths: enabling the front USB port during boot to gain root access (F01), reading/modifying firmware via JTAG (F02), loading unsigned firmware due to absent secure boot (F03), modifying firmware via unverified upgrade mechanisms (F04), and tampering with the tamper event log itself (F05). Attack requires physical proximity to the device but no authentication or user interaction. Patches are available in versions 13.6.12 (LTS) and 13.9.0 (STS).

## Affected products

- Entrust nShield Connect XC through 13.6.11 (patched in 13.6.12 LTS and 13.9.0 STS)
- Entrust nShield 5c through 13.6.11 (patched in 13.6.12 LTS and 13.9.0 STS)
- Entrust nShield HSMi through 13.6.11, or 13.7 (patched in 13.6.12 LTS and 13.9.0 STS)

## Timeline

- 2025-09-22: disclosed: Google Security Research advisory published (GHSA-6q4x-m86j-gfwj)
- 2025-12-02: advisory: CVE-2025-59703 published to NVD and GitHub Advisory Database
- 2025: patched: Patch available in nShield 13.6.12 (LTS) and 13.9.0 (STS)

## References

- [https://github.com/google/security-research/security/advisories/GHSA-6q4x-m86j-gfwj](https://github.com/google/security-research/security/advisories/GHSA-6q4x-m86j-gfwj)

## Related threats

- [Entrust nShield HSM BIOS access without password authentication](https://junglewise.ai/threats/cve-2025-59704-entrust-nshield-hsm-bios-access-without-password-authentication)
- [Entrust nShield HSM USB interface privilege escalation via physical access](https://junglewise.ai/threats/cve-2025-59705-entrust-nshield-hsm-usb-interface-privilege-escalation-via)
- [Entrust nShield HSM tamper event falsification via physical access](https://junglewise.ai/threats/cve-2025-59702-entrust-nshield-hsm-tamper-event-falsification-via-physical)
- [Entrust nShield unencrypted SSD storage access](https://junglewise.ai/threats/cve-2025-59701-entrust-nshield-unencrypted-ssd-storage-access)
- [Entrust nShield HSM recovery partition integrity vulnerability](https://junglewise.ai/threats/cve-2025-59700-entrust-nshield-hsm-recovery-partition-integrity-vulnerability)