Auth bypass in Entrust Nshield_5c
CVE-2025-59704
Entrust nShield Connect XC, nShield 5c, and nShield HSMi through 13.6.11, or 13.7, allow an attacker to gain access the the BIOS menu because is has no password.
Vulnerability class: Broken Authentication
EPSS: 0.002 (11.4th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 4.6 (Medium). Vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N.
Affected products
- Entrust Nshield_5c
- Entrust Nshield_5c_firmware
- Entrust Nshield_connect_xc_base
- Entrust Nshield_connect_xc_base_firmware
- Entrust Nshield_connect_xc_high
- Entrust Nshield_connect_xc_high_firmware
- Entrust Nshield_connect_xc_mid
- Entrust Nshield_connect_xc_mid_firmware
- Entrust Nshield_hsmi
- Entrust Nshield_hsmi_firmware
Weakness classification (CWE)
References
- cve@mitre.org (Product)
- cve@mitre.org (Exploit, Third Party Advisory)
Frequently asked questions
- What is CVE-2025-59704?
- CVE-2025-59704 is a medium-severity vulnerability in Entrust Nshield_5c, classified under Improper Authentication. CVSS score: 4.6/10. Published 2025-12-02.
- How severe is CVE-2025-59704?
- Medium severity. CVSS v3 base score is 4.6 out of 10.