Overview
CVE-2025-59704 details a vulnerability affecting Entrust nShield Connect XC, nShield 5c, and nShield HSMi hardware security modules (HSMs). The issue stems from the lack of a password protecting the BIOS menu, potentially allowing an attacker with physical access to gain unauthorized control over the device’s low-level settings.
Technical Details
The vulnerability exists in Entrust nShield Connect XC, nShield 5c, and nShield HSMi devices running firmware versions up to and including 13.6.11, and also version 13.7. The absence of a BIOS password allows an attacker with physical access to the HSM to enter the BIOS setup. From there, the attacker could potentially modify boot settings, disable security features, or load malicious firmware, bypassing the intended security controls of the HSM.
The specific components vulnerable are the system BIOS of the affected nShield HSM devices. Exploitation requires physical access to the device.
CVSS Analysis
Currently, a CVSS score is unavailable for CVE-2025-59704 (N/A). While the absence of a CVSS score might suggest low criticality, the implications of this vulnerability in the context of an HSM should not be underestimated. The reliance on physical access to exploit lowers the accessibility score; however, a successful exploit can lead to severe consequences.
A potential CVSS score would likely be in the Medium to High range, primarily driven by the Confidentiality, Integrity, and Availability impact on the HSM and the sensitive data it protects. The low Attack Vector (physical access) tempers the score down from Critical.
Possible Impact
The potential impact of CVE-2025-59704 is significant, considering the sensitive nature of the data protected by HSMs. Successful exploitation could lead to:
- Compromise of cryptographic keys: Attackers could extract or manipulate cryptographic keys stored within the HSM.
- Data breaches: Compromised keys can lead to decryption of sensitive data protected by the HSM.
- System compromise: Modifying boot settings or flashing malicious firmware could completely compromise the HSM’s functionality and security posture.
- Compliance violations: Security breaches stemming from this vulnerability could result in non-compliance with industry regulations and legal mandates.
- Loss of trust: Clients relying on the HSM to protect their sensitive data will lose trust in the HSM provider and the affected organization.
Mitigation or Patch Steps
Entrust has been notified and is expected to release a patch addressing this vulnerability. In the interim, the following mitigation steps are recommended:
- Physical security: Ensure strong physical security controls around the HSMs to prevent unauthorized access. Restrict physical access to authorized personnel only.
- Monitor for suspicious activity: Implement monitoring solutions to detect any unusual activity or unauthorized attempts to access the HSMs.
- Stay updated: Monitor Entrust’s security advisories for the release of a patch and apply it promptly once available. Subscribe to Entrust’s notification service for up-to-date security alerts.
- Network Segmentation: Isolate the HSMs on a separate network segment to limit the blast radius in case of a compromise.
