CVE-2025-59702: Entrust Nshield 5c Privilege Escalation

CVE-2025-59702 Overview

CVE-2025-59702 affects Entrust nShield hardware security modules (HSMs), including nShield Connect XC, nShield 5c, and nShield HSMi through firmware versions 13.6.11 and 13.7. A physically proximate attacker with elevated privileges can falsify tamper events by accessing internal components of the device. The flaw maps to [CWE-203], an observable discrepancy that undermines the integrity of tamper detection. HSMs are trusted anchors for cryptographic operations, so any weakness in tamper reporting reduces assurance that keys and audit trails remain trustworthy.

Critical Impact
An attacker with physical access and elevated privileges can spoof tamper events, undermining the integrity guarantees that make HSMs a root of trust for enterprise cryptography.

Affected Products

Entrust nShield Connect XC (Base, Mid, High) through firmware 13.6.11 or 13.7
Entrust nShield 5c through firmware 13.6.11 or 13.7
Entrust nShield HSMi through firmware 13.6.11 or 13.7

Discovery Timeline

2025-12-02 - CVE-2025-59702 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-59702

Vulnerability Analysis

The vulnerability targets the tamper detection subsystem of Entrust nShield HSMs. Tamper mechanisms are designed to detect and record physical intrusions, then trigger key zeroization or audit signals. In these devices, an attacker who reaches internal components can manipulate signals so that fabricated tamper events are recorded. This creates an observable discrepancy between the physical state of the device and the events logged by the firmware.

Because HSMs act as roots of trust for signing, TLS, PKI, and key management workflows, falsified tamper telemetry can be used to mask real intrusions or to induce operational responses such as forced key destruction, service outages, or unnecessary emergency procedures. The vulnerability affects both the nShield 5c and Connect XC network-attached HSM families as well as the HSMi variant.

Root Cause

The root cause lies in how tamper signals are generated and validated inside the module. Internal components can be accessed and driven in a way that mimics a genuine tamper condition. Under [CWE-203], the firmware cannot distinguish a legitimate tamper event from one produced by a privileged, physically present adversary.

Attack Vector

Exploitation requires physical proximity and high privileges on the device. The attacker must open or manipulate the HSM chassis to reach internal components and inject falsified tamper indicators. No user interaction is required, and the scope is changed because a fabricated tamper event impacts systems and audit chains that depend on the HSM. Full technical details are described in the GitHub Security Advisory.

Detection Methods for CVE-2025-59702

Indicators of Compromise

Unexplained tamper event log entries on nShield Connect XC, nShield 5c, or nShield HSMi devices with no matching environmental or maintenance record.
HSM state transitions to a tampered or zeroized condition outside of scheduled maintenance windows.
Physical evidence of chassis access, seal breakage, or removed screws on rack-mounted HSM appliances.

Detection Strategies

Correlate HSM syslog and audit exports with data center access logs, badge records, and CCTV footage to validate every tamper event against a physical presence record.
Baseline the frequency and timing of tamper events across the HSM fleet and alert on statistical outliers.
Ingest HSM audit streams into a centralized SIEM or data lake to enable long-term trend analysis and cross-source correlation.

Monitoring Recommendations

Forward nShield audit and status logs to a centralized logging platform with tamper-evident retention.
Monitor for privileged administrative sessions on HSM management interfaces that occur close in time to reported tamper events.
Track firmware versions across the fleet and alert on any device running vulnerable 13.6.11 or 13.7 builds.

How to Mitigate CVE-2025-59702

Immediate Actions Required

Inventory all Entrust nShield Connect XC, nShield 5c, and nShield HSMi devices and identify units running firmware 13.6.11, 13.7, or earlier.
Restrict physical access to HSMs to a minimum set of named administrators and enforce dual-control procedures for chassis-level work.
Enable tamper-evident seals and continuous CCTV coverage on all HSM cabinets and hot aisles.

Patch Information

Entrust has not published a fixed firmware version in the referenced advisory data. Operators should track the GitHub Security Advisory and Entrust support channels for updated firmware releases addressing CVE-2025-59702, and apply them following standard HSM change control.

Workarounds

Enforce strict physical security controls, including locked cabinets, biometric access, and mandatory two-person integrity for any HSM handling.
Require independent verification of tamper events through out-of-band physical inspection before initiating key destruction or failover procedures.
Rotate and re-verify HSM administrator credentials, and audit who holds Security World or ACS card sets that grant elevated privileges.

bash

# Configuration example
# Export nShield audit logs to a central syslog collector for correlation
/opt/nfast/bin/enquiry
/opt/nfast/bin/nethsmadmin --module 1 --show-tamper-log
# Forward logs via rsyslog
echo '*.* @@siem.internal.example.com:6514' >> /etc/rsyslog.d/50-nshield.conf
systemctl restart rsyslog