CVE-2025-59704

MEDIUM

Entrust nShield Connect XC, nShield 5c, and nShield HSMi < 13.6.12 - Unauthenticated BIOS Access via Missing Password

Title source: llm

Description

Entrust nShield Connect XC, nShield 5c, and nShield HSMi through 13.6.11, or 13.7, allow an attacker to gain access the the BIOS menu because is has no password.

References (2)

Core 2

Core References

Exploit, Third Party Advisory

https://github.com/google/security-research/security/advisories/GHSA-6q4x-m86j-gfwj

Product

https://www.entrust.com/use-case/why-use-an-hsm

Scores

CVSS v3 4.6

EPSS 0.0020

EPSS Percentile 10.2%

Attack Vector PHYSICAL

CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

CISA SSVC

Vulnrichment

Exploitation poc

Automatable yes

Technical Impact total

Details

CWE

CWE-287

Status published

Products (5)

entrust/nshield_5c_firmware < 13.6.12

entrust/nshield_connect_xc_base_firmware < 13.6.12

entrust/nshield_connect_xc_high_firmware < 13.6.12

entrust/nshield_connect_xc_mid_firmware < 13.6.12

entrust/nshield_hsmi_firmware < 13.6.12

Published Dec 02, 2025

Tracked Since Feb 18, 2026