← Vulnerability feed

Vulnerability record · CVE-2025-59699 · published 2 December 2025

CVE-2025-59699: Entrust nshield 5c firmware authentication bypass by spoofing vulnerability

Entrust · Nshield 5c Firmware

Entrust nShield Connect XC, nShield 5c, and nShield HSMi through 13.6.11, or 13.7 (patched in 13.6.12 (LTS) and 13.9.0 (STS)), allow a physically proximate attacker to escalate privileges by booting from a USB device with a valid root filesystem. This occurs because of insecure default settings in the Legacy GRUB Bootloader.

6.8 CVSS 3.1 Medium EPSS 0.33% · top 76.5% CWE-290 · Authentication bypass by spoofing
6.8CVSS 3.1 base score
0.33%EPSS exploitation probability, 30 days
NoNot in CISA KEV
5Affected product versions listed by NVD
4References, 1 tagged exploit
26 Aug 2026Last modified by NVD

Description

Entrust nShield Connect XC, nShield 5c, and nShield HSMi through 13.6.11, or 13.7 (patched in 13.6.12 (LTS) and 13.9.0 (STS)), allow a physically proximate attacker to escalate privileges by booting from a USB device with a valid root filesystem. This occurs because of insecure default settings in the Legacy GRUB Bootloader.

CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

5 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/advisories/GHSA-g9v7-h8x8-w5vw
https://github.com/google/security-research/security/advisories/GHSA-6q4x-m86j-gfwj ExploitThird Party Advisory
https://www.entrust.com/knowledgebase/hardware/understanding-nshield-security-advisory-september-2025
https://www.entrust.com/use-case/why-use-an-hsm Product

Track CVE-2025-59699 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2025-59695Entrust nshield 5c firmware missing authentication for critical function vulnerabilityEntrust nShield Connect XC, nShield 5c, and nShield HSMi through 13.6.11, or 13.7 (patched in 13.6.12 (LTS) and 13.9.0 (STS)), allow a user with OS r…EPSS 0.67%9.8CVE-2025-59693Entrust nshield 5c firmware improper privilege management vulnerabilityThe Chassis Management Board in Entrust nShield Connect XC, nShield 5c, and nShield HSMi through 13.6.11, or 13.7 (patched in 13.6.12 (LTS) and 13.9.…EPSS 0.90%9.1CVE-2025-59703Entrust nshield 5c firmware improper access control vulnerabilityEntrust nShield Connect XC, nShield 5c, and nShield HSMi through 13.6.11, or 13.7 (patched in 13.6.12 (LTS) and 13.9.0 (STS)), allow a Physically Pro…EPSS 0.46%7.2CVE-2025-59697Entrust nshield 5c firmware improper privilege management vulnerabilityEntrust nShield Connect XC, nShield 5c, and nShield HSMi through 13.6.11, or 13.7 (patched in 13.6.12 (LTS) and 13.9.0 (STS)), allow a physically pro…EPSS 0.31%7.2CVE-2025-59702Entrust nshield 5c firmware observable discrepancy vulnerabilityEntrust nShield Connect XC, nShield 5c, and nShield HSMi through 13.6.11, or 13.7 (patched in 13.6.12 (LTS) and 13.9.0 (STS)), allow a physically pro…EPSS 0.31%6.8CVE-2025-59705Entrust nshield 5c firmware improper privilege management vulnerabilityEntrust nShield Connect XC, nShield 5c, and nShield HSMi through 13.6.11, or 13.7 (patched in 13.6.12 (LTS) and 13.9.0 (STS)), allow a Physically Pro…EPSS 0.33%6.8CVE-2025-59698Entrust nshield 5c firmware vulnerabilityEntrust nShield Connect XC, nShield 5c, and nShield HSMi through 13.6.11, or 13.7 (patched in 13.6.12 (LTS) and 13.9.0 (STS)), might allow a physical…EPSS 0.33%6.8CVE-2025-59694Entrust nshield 5c firmware vulnerabilityThe Chassis Management Board in Entrust nShield Connect XC, nShield 5c, and nShield HSMi through 13.6.11, or 13.7 (patched in 13.6.12 (LTS) and 13.9.…EPSS 0.32%

Source: NIST National Vulnerability Database (record CVE-2025-59699), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.