CVE-2025-59703
Entrust nShield Connect XC, nShield 5c, and nShield HSMi through 13.6.11, or 13.7 (patched in 13.6.12 (LTS) and 13.9.0 (STS)), allow a Physically Proximate Attacker to access the internal components of the appliance, without leaving tamper evidence.
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (0.46%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
Entrust nShield Connect XC, nShield 5c, and nShield HSMi through 13.6.11, or 13.7 (patched in 13.6.12 (LTS) and 13.9.0 (STS)), allow a Physically Proximate Attacker to access the internal components of the appliance, without leaving tamper evidence. To exploit this, the attacker needs to remove the tamper label and all fixing screws from the device without damaging it. This is called an F14 attack.
- CVSS 3.1
- 9.1 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
- EPSS
- 0.46% probability · 39th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-284
- Affected
- entrust/nshield 5c firmware · entrust/nshield hsmi firmware · entrust/nshield connect xc base firmware · entrust/nshield connect xc mid firmware · entrust/nshield connect xc high firmware
- Source
- cve@mitre.org
References
- https://github.com/advisories/GHSA-h78c-68qv-3qg9
- https://github.com/google/security-research/security/advisories/GHSA-6q4x-m86j-gfwjExploit, Third Party Advisory
- https://www.entrust.com/knowledgebase/hardware/understanding-nshield-security-advisory-september-2025
- https://www.entrust.com/use-case/why-use-an-hsmProduct
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.