CVE-2025-59700
Entrust Nshield 5C Firmware ≤ 13.6.12
Raw vector
CVSS:3.1/AV:P/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:NSummary
CVE-2025-59700 is a low-severity Insufficient Verification of Data Authenticity (CWE-345) vulnerability in Entrust Nshield 5C Firmware. Its CVSS base score is 3.9 (Low).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified map to PE-3 (Physical Access Control) and SI-7 (Software, Firmware, and Information Integrity) — see the control section below for these in your framework.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-200254
Vulnerability Data
Entrust nShield Connect XC, nShield 5c, and nShield HSMi through 13.6.11, or 13.7, allow a physically proximate attacker with root access to modify the Recovery Partition (because of a lack of integrity protection).
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Vulnerabilities enable privilege escalation to root via physical access (T1068), firmware/boot chain and recovery partition modification for pre-OS persistence and recovery inhibition (T1542.001, T1542.002, T1490, T1601.001), and indicator removal by editing unprotected tamper logs (T1070).
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
Mitigating Controls (NIST 800-53 r5) AI
Directly requires cryptographic integrity verification of firmware/partitions, which is absent on the Recovery Partition in this CVE.
Enforces physical access restrictions to HSM hardware, blocking the physically proximate attacker prerequisite for this CVE.
Mandates non-modifiable executable programs or partitions, mitigating unauthorized modification of the Recovery Partition.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
CWE-345 directly impairs RC.RP-05's verification of restored-asset integrity/authenticity, largely defeating the outcome while still leaving other restoration-confirmation steps partially viable.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing can detect missing or weak data authenticity verification.
Network controls can enforce authenticated channels, reducing risk of accepting unauthentic data.
Secure network services often include authenticity checks for data exchanged over those services.
Cryptographic mechanisms directly verify data origin and integrity, preventing acceptance of unauthentic data.
Secure SDLC incorporates authenticity verification requirements throughout development.
Application security requirements can mandate data authenticity verification mechanisms.