CVE-2025-59694 Overview
CVE-2025-59694 affects the Chassis Management Board (CMB) in Entrust nShield Connect XC, nShield 5c, and nShield HSMi hardware security modules (HSMs) through firmware versions 13.6.11 and 13.7. A physically proximate attacker can persistently modify the CMB firmware and influence the appliance boot process, which is insecurely configured. Exploitation requires modifying firmware via Joint Test Action Group (JTAG) interfaces or performing a CMB firmware upgrade. The issue is tracked by Entrust as F03 and is classified under CWE-1274: Improper Access Control for Volatile Memory Containing Boot Code.
Critical Impact
An attacker with physical access can implant persistent malicious firmware on cryptographic appliances that protect signing keys, certificate authorities, and high-value secrets.
Affected Products
- Entrust nShield Connect XC (Base, Mid, High) through firmware 13.6.11 / 13.7
- Entrust nShield 5c through firmware 13.6.11 / 13.7
- Entrust nShield HSMi through firmware 13.6.11 / 13.7
Discovery Timeline
- 2025-12-02 - CVE-2025-59694 published to the National Vulnerability Database
- 2025-12-15 - Last updated in NVD database
Technical Details for CVE-2025-59694
Vulnerability Analysis
The Chassis Management Board is the supervisory controller responsible for power sequencing, environmental monitoring, and orchestrating the secure boot chain of the HSM appliance. Because the appliance boot process is insecurely configured, the CMB firmware is trusted without sufficient cryptographic verification of its integrity prior to execution. An attacker who alters the CMB firmware can therefore influence what subsequently boots on the appliance, including the components that handle key material.
This is a hardware-layer firmware vulnerability rather than a remote software flaw. The attacker must be physically proximate to the device to either attach to the JTAG debug interface or push a modified CMB firmware image through the upgrade path. Once installed, the modified firmware persists across reboots and survives normal operational lifecycles.
Root Cause
The root cause is improper access control over boot code stored in volatile and non-volatile memory on the CMB (CWE-1274). The boot configuration does not enforce verified-boot semantics for CMB firmware, so a tampered image is accepted and executed.
Attack Vector
Exploitation requires physical proximity to the appliance. The attacker either connects to the JTAG interface on the chassis management board to overwrite firmware directly, or stages a malicious firmware image and triggers a CMB upgrade. No authentication credentials, user interaction, or network access are required once physical access is obtained.
No verified public proof-of-concept code is available. See the GitHub Security Advisory GHSA-6q4x-m86j-gfwj for the original research and technical narrative.
Detection Methods for CVE-2025-59694
Indicators of Compromise
- Unexpected CMB firmware version strings or hashes reported by nShield management tooling that do not match the vendor-published baseline.
- Tamper-evident seal damage on chassis access panels or visible attachment to JTAG headers on the physical unit.
- Unscheduled CMB firmware upgrades in appliance audit logs, particularly outside change-management windows.
Detection Strategies
- Compare CMB firmware checksums against the manufacturer's published values after every maintenance event and on a recurring schedule.
- Validate boot-time integrity attestations and log any deviation from the expected boot measurement chain.
- Correlate physical access badge logs against HSM audit events that record firmware modification or upgrade activity.
Monitoring Recommendations
- Forward HSM appliance audit logs and chassis-tamper sensor events to a centralized SIEM for retention and correlation.
- Alert on any firmware upgrade event targeting the CMB component, regardless of source.
- Monitor data-center camera and access systems covering racks containing nShield Connect XC, 5c, and HSMi devices.
How to Mitigate CVE-2025-59694
Immediate Actions Required
- Inventory all nShield Connect XC, nShield 5c, and nShield HSMi units and identify those running firmware 13.6.11 or 13.7 and earlier.
- Restrict physical access to HSM appliances to a minimum set of authorized personnel and verify tamper-evident seals.
- Review CMB firmware versions and recent upgrade history on every affected appliance.
Patch Information
Entrust has not published a fixed firmware version in the data referenced by this advisory. Operators should consult Entrust support and the GitHub Security Advisory GHSA-6q4x-m86j-gfwj for vendor remediation guidance and apply any released firmware update covering issue F03.
Workarounds
- Enforce strict physical security controls including locked racks, multi-person access policies, and continuous video monitoring for cabinets hosting affected HSMs.
- Disable or physically block JTAG and debug headers where supported by operational procedures and vendor guidance.
- Treat any appliance with broken tamper-evidence or unexplained downtime as potentially compromised and rotate cryptographic material managed by that unit.
- Restrict CMB firmware upgrade privileges to a documented, dual-control change process with cryptographic verification of the upgrade image.
# Example operational check using nShield tooling to enumerate firmware versions
# Replace with the appropriate utility for your deployment
enquiry | grep -Ei "version|firmware|chassis"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
