CVE-2025-59704 — MEDIUM (4.6)

Q: What is CVE-2025-59704?

CVE-2025-59704 is a vulnerability with a CVSS score of 4.6 (MEDIUM). Entrust nShield Connect XC, nShield 5c, and nShield HSMi through 13.6.11, or 13.7, allow an attacker to gain access the the BIOS menu because is has no password.

Q: How severe is CVE-2025-59704?

CVE-2025-59704 has been rated MEDIUM with a CVSS base score of 4.6/10. Review the CVSS metrics above for detailed severity breakdown.

Q: Is there a patch for CVE-2025-59704?

Check the references section above for vendor advisories and patch information. Affected products include: Entrust Nshield 5C Firmware, Entrust Nshield 5C, Entrust Nshield Hsmi Firmware, Entrust Nshield Hsmi, Entrust Nshield Connect Xc Base Firmware.

Vulnerability Description

Entrust nShield Connect XC, nShield 5c, and nShield HSMi through 13.6.11, or 13.7, allow an attacker to gain access the the BIOS menu because is has no password.

CVSS Score

4.6

MEDIUM

CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Attack Vector

PHYSICAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

NONE

Integrity

HIGH

Availability

NONE

Affected Products

Vendor	Product	Versions
Entrust	Nshield 5C Firmware	< 13.6.12
Entrust	Nshield 5C	-
Entrust	Nshield Hsmi Firmware	< 13.6.12
Entrust	Nshield Hsmi	-
Entrust	Nshield Connect Xc Base Firmware	< 13.6.12
Entrust	Nshield Connect Xc Base	-
Entrust	Nshield Connect Xc Mid Firmware	< 13.6.12
Entrust	Nshield Connect Xc Mid	-
Entrust	Nshield Connect Xc High Firmware	< 13.6.12
Entrust	Nshield Connect Xc High	-

Related Weaknesses (CWE)

CWE-287

References

https://github.com/google/security-research/security/advisories/GHSA-6q4x-m86j-gExploitThird Party Advisory
https://www.entrust.com/use-case/why-use-an-hsmProduct

FAQ

What is CVE-2025-59704?

CVE-2025-59704 is a vulnerability with a CVSS score of 4.6 (MEDIUM). Entrust nShield Connect XC, nShield 5c, and nShield HSMi through 13.6.11, or 13.7, allow an attacker to gain access the the BIOS menu because is has no password.

How severe is CVE-2025-59704?

CVE-2025-59704 has been rated MEDIUM with a CVSS base score of 4.6/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2025-59704?

Check the references section above for vendor advisories and patch information. Affected products include: Entrust Nshield 5C Firmware, Entrust Nshield 5C, Entrust Nshield Hsmi Firmware, Entrust Nshield Hsmi, Entrust Nshield Connect Xc Base Firmware.