CVE-2025-59703
CWE-284Published: December 2, 2025· Updated: Jun 17, 2026
Official Description
Entrust nShield Connect XC, nShield 5c, and nShield HSMi through 13.6.11, or 13.7, allow a Physically Proximate Attacker to access the internal components of the appliance, without leaving tamper evidence. To exploit this, the attacker needs to remove the tamper label and all fixing screws from the device without damaging it. This is called an F14 attack.
Risk Analysis
This critical vulnerability in Entrust nShield Connect XC, nShield 5c, and nShield HSMi allows a physically proximate attacker to access internal components without leaving tamper evidence. With a CVSS score of 9.1, this flaw is highly severe and could lead to complete compromise of confidentiality, integrity, and availability if exploited. The absence of an EPSS score means there is no current data on its exploitation likelihood, but its critical severity warrants immediate attention.
No public exploit is currently known for this vulnerability. Exploitation requires physical proximity to the device, involving the removal of tamper labels and screws.
Users of affected Entrust nShield devices should ensure physical security measures are robust to prevent unauthorized access. Consult Entrust for specific patching or mitigation guidance for versions through 13.6.11 or 13.7.
Technical Analysis
CVE-2025-59703 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.
The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.
A successful exploit results in complete confidentiality breach (data exposure), full integrity compromise (data manipulation), with a CVSS base score of 9.1.
CVSS v3.1 Vector Breakdown
Affected Vendors & Products
Exploit & PoC Resources
Official Patches & Advisories
All References (2)
Quick Facts
Related CVEs (CWE-284)
Recommended Actions
- →Apply vendor patches immediately
- →Monitor CVE-2025-59703 in threat intel feeds
- →Review IDS/IPS signatures for exploitation attempts