CVE-2025-59705: Entrust nShield HSM USB interface privilege escalation via physical access

CVE-2025-59705 · Severity: medium · CVSS 6.8 · Published 2025-12-02

Entrust nShield HSM devices (including Connect XC, 5c, and HSMi models) use a hardware security module to protect cryptographic keys for enterprise applications. An attacker with physical access can bypass security controls by connecting to a pin during device boot to enable the USB interface, then use keyboard input during startup to gain root access to the appliance. This allows complete compromise of the device without triggering tamper alarms or leaving visible evidence.

Technologies: Entrust nShield Connect XC, Entrust Nshield 5c, Entrust Nshield Hsmi. Vendors: Entrust.

Quick answers

Is CVE-2025-59705 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2025-59705 being exploited in the wild.
How severe is CVE-2025-59705?
Medium severity, with a CVSS score of 6.8, published 2 December 2025.
Which products and versions are affected?
Entrust nShield Connect XC through 13.6.11 or 13.7 (patched in 13.6.12 LTS, 13.9.0 STS); Entrust Nshield 5c through 13.6.11 or 13.7 (patched in 13.6.12 LTS, 13.9.0 STS); Entrust Nshield Hsmi through 13.6.11 or 13.7 (patched in 13.6.12 LTS, 13.9.0 STS).
Is there a fix for CVE-2025-59705?
A patch was published on 2025-09-22: Patches available: v13.6.12 (LTS) and v13.9.0 (STS) Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-59705 attacked?
It is attacked with physical access, in a network appliance.
Am I affected by CVE-2025-59705?
Check whether you run Entrust nShield Connect XC, Entrust Nshield 5c or Entrust Nshield Hsmi at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

This vulnerability comprises multiple related privilege escalation issues (F01-F05) in the nShield boot chain and firmware protection mechanisms. F01 specifically allows a physically proximate attacker to enable the USB interface by connecting to an exposed pin during system boot, which does not trigger tamper events. Once USB is enabled, an attacker can attach a keyboard and repeatedly interrupt the GRUB boot process to gain an interactive shell, leading to root access. The root cause is insufficient physical security controls and the lack of secure boot verification. Attack requires physical proximity to the device during boot sequence. Patches are available in 13.6.12 (LTS) and 13.9.0 (STS).

Affected products

  • Entrust nShield Connect XC through 13.6.11 or 13.7 (patched in 13.6.12 LTS, 13.9.0 STS)
  • Entrust nShield 5c through 13.6.11 or 13.7 (patched in 13.6.12 LTS, 13.9.0 STS)
  • Entrust nShield HSMi through 13.6.11 or 13.7 (patched in 13.6.12 LTS, 13.9.0 STS)

Timeline

  • 2025-09-22: disclosed: Google Security Research advisory published
  • 2025-12-02: disclosed: CVE-2025-59705 published on NVD
  • 2025-09-22: patched: Patches available: v13.6.12 (LTS) and v13.9.0 (STS)

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.