PT-2025-48690 · Entrust · Entrust Nshield Connect Xc+2

Published 2025-12-02 · Updated 2025-12-15 · CVE-2025-59693

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Entrust nShield Connect XC versions through 13.6.11 Entrust nShield 5c versions through 13.6.11 Entrust nShield HSMi versions through 13.6.11 Entrust nShield Connect XC version 13.7 Entrust nShield 5c version 13.7 Entrust nShield HSMi version 13.7

Description A physically proximate attacker can gain debug access and escalate privileges on the Chassis Management Board. This is achieved by bypassing the tamper label and opening the chassis without leaving evidence, then accessing the JTAG connector. This issue is identified as F02.

Recommendations Update Entrust nShield Connect XC to a version later than 13.6.11 or 13.7. Update Entrust nShield 5c to a version later than 13.6.11 or 13.7. Update Entrust nShield HSMi to a version later than 13.6.11 or 13.7.

Exploit

Fix

Improper Privilege Management

Weakness Enumeration

CWE-269

Related Identifiers

CVE-2025-59693

GHSA-6Q4X-M86J-GFWJ

Affected Products

Entrust Nshield 5C

Entrust Nshield Connect Xc

Entrust Nshield Hsmi

References · 6

• 🔥 https://github.com/google/security-research/security/advisories/GHSA-6q4x-m86j-gfwj · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-59693 · Security Note
• https://osv.dev/vulnerability/CVE-2025-59693 · Vendor Advisory
• https://twitter.com/CVEnew/status/1995876181061627917 · Twitter Post
• https://t.me/cveNotify/145759 · Telegram Post
• https://entrust.com/use-case/why-use-an-hsm · Note