PT-2025-48700 · Entrust · Entrust Nshield Connect Xc+2

CVE-2025-59699 · Publicado 2025-12-02 · Atualizado 2025-12-08

Positive Technologies (AI Summary)

CVSS v3.1

6.8

Média

Vetor base

AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Entrust nShield Connect XC versions through 13.6.11 Entrust nShield 5c versions through 13.6.11 Entrust nShield HSMi versions through 13.6.11 Entrust nShield Connect XC version 13.7 Entrust nShield 5c version 13.7 Entrust nShield HSMi version 13.7

Description A physically proximate attacker can escalate privileges by booting from a USB device containing a valid root filesystem. This is due to insecure default settings within the Legacy GRUB Bootloader.

Recommendations Update Entrust nShield Connect XC to a version later than 13.6.11 or 13.7. Update Entrust nShield 5c to a version later than 13.6.11 or 13.7. Update Entrust nShield HSMi to a version later than 13.6.11 or 13.7.

Exploit

Correção

LPE

Authentication Bypass by Spoofing

Enumeração de Fraquezas

CWE-290

Identificadores relacionados

CVE-2025-59699

GHSA-6Q4X-M86J-GFWJ

Produtos afetados

Entrust Nshield 5C

Entrust Nshield Connect Xc

Entrust Nshield Hsmi

Referências · 8

• 🔥 https://github.com/google/security-research/security/advisories/GHSA-6q4x-m86j-gfwj · Exploit
• https://t.me/CVEtracker/38681 · Publicação no Telegram
• https://entrust.com/use-case/why-use-an-hsm · Nota
• https://t.me/cveNotify/145176 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2025-59699 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2025-59699 · Nota de Segurança
• https://twitter.com/VulmonFeeds/status/1996026869280350235 · Publicação no Twitter
• https://twitter.com/CVEnew/status/1995876187176857614 · Publicação no Twitter