CVE-2025-59104
Raw vector
CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XSummary
CVE-2025-59104 is a high-severity Hardware Internal or Debug Modes Allow Override of Locks (CWE-1234) vulnerability in Sec Consult (inferred from references). Its CVSS base score is 7.0 (High).
Operationally, ranked at the 6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SC-51 (Hardware-based Protection) and CM-7 (Least Functionality) — see the control section below for these in your framework.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-206371
Vulnerability Data
With physical access to the device and enough time an attacker is able to solder test leads to the debug footprint (or use the 6-Pin tag-connect cable). Thus, the attacker gains access to the bootloader, where the kernel command line…
more
can be changed. An attacker is able to gain a root shell through this vulnerability.
- CWE(s)
Related Threats
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Hardware-enforced write protection on configuration registers or fuses directly blocks debug-mode bypass of locks.
Restricting debug or maintenance functions to least functionality stops the debug-mode override path from being reachable.
Isolating security functions from non-security functions (including debug logic) structurally prevents lock overrides from debug modes.
Tamper-resistance mechanisms reduce the ability of debug interfaces to alter protected state even if the mode is entered.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Hardware integrity assessment prior to acquisition directly evaluates secure debug/lock behavior.
Hardened configuration baselines can disable or lock debug modes in production hardware.
Identifying hardware vulnerabilities can surface debug-mode bypass risks before deployment.
Hardware replacement decisions can address devices lacking proper debug-lock protections.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing may detect debug-mode bypasses but does not prevent the underlying hardware weakness.
Restricting privileged utility programs limits debug access, but does not guarantee hardware lock protection.
Privileged access rights can restrict debug-mode overrides but do not specifically address hardware lock bypass.
Secure system architecture and engineering principles can mandate hardware lock enforcement during debug, covering most of the weakness.
Configuration management can enforce secure debug settings, yet hardware-level lock bypass may still occur outside its scope.