CVE-2025-59696
Entrust Nshield 5C Firmware ≤ 13.6.12
Raw vector
CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:NSummary
CVE-2025-59696 is a low-severity Improper Physical Access Control (CWE-1263) vulnerability in Entrust Nshield 5C Firmware. Its CVSS base score is 3.2 (Low).
Operationally, exploitation aligns with the MITRE ATT&CK technique Replication Through Removable Media (T1091); ranked at the 11th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified map to PE-2 (Physical Access Authorizations) and PE-3 (Physical Access Control) — see the control section below for these in your framework.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-200258
Vulnerability Data
Entrust nShield Connect XC, nShield 5c, and nShield HSMi through 13.6.11, or 13.7, allow a physically proximate attacker to modify or erase tamper events via the Chassis management board.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
- 6 hardening rules · 3 OS baselines
—
Mitigating Controls (NIST 800-53 r5) AI
Directly enforces physical access authorizations at entry points to restricted areas.
Maintains the authorized physical access list that the system must enforce.
Monitors physical access to detect unauthorized entry after the fact.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Directly requires managing, monitoring, and enforcing physical access to assets commensurate with risk.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Specifies physical entry controls that prevent unauthorized actors from reaching protected information or assets.
Defines physical perimeters that directly limit unauthorized physical access to restricted areas.
Secure disposal prevents data exposure after equipment leaves controlled areas.
Requires securing offices, rooms and facilities to restrict physical access to areas containing sensitive information.
Monitoring supports detection but does not itself prevent unauthorized physical access.
Equipment siting helps reduce exposure but is secondary to access-control measures.
Hardening callouts derived
Configuration rules from DISA STIG baselines that bear on weaknesses of the type cited by this CVE. Each rule is shown with the relationship its mapping actually records, against the CWE it was authored against. Derived via CVE→CWE over `controls_xwalks` (authoritative rows only; rows rated `none` are excluded).
Oracle Linux 8 (2 rules)
- V-248537 OL 8 operating systems booted with United Extensible Firmware Interface (UEFI) must require authentication upon booting into single-user mode and maintenance. prevents CWE-1263
- V-248540 OL 8 operating systems booted with a BIOS must require authentication upon booting into single-user and maintenance modes. prevents CWE-1263
RHEL 7 (2 rules)
- V-204440 Red Hat Enterprise Linux operating systems version 7.2 or newer using Unified Extensible Firmware Interface (UEFI) must require authentication upon booting into single-user and maintenance modes. prevents CWE-1263
- V-204438 Red Hat Enterprise Linux operating systems version 7.2 or newer with a Basic Input/Output System (BIOS) must require authentication upon booting into single-user and maintenance modes. prevents CWE-1263