CVE-2025-59702

HighCVSS 7.2/10Last modified Aug 26, 2026

Description

Entrust nShield Connect XC, nShield 5c, and nShield HSMi through 13.6.11, or 13.7 (patched in 13.6.12 (LTS) and 13.9.0 (STS)), allow a physically proximate attacker with elevated privileges to falsify tamper events by accessing internal components.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:P/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-203CWE-284

Affected software

No affected versions have been published.

Timeline

Published
Dec 2, 2025
Last modified
Aug 26, 2026
NVD status
Modified

Related CVEs from 2025

CVE-2025-597039.1Entrust nShield Connect XC, nShield 5c, and nShield HSMi through 13.6.11, or 13.7 (patched in 13.6.12 (LTS) and 13.9.0 (STS)), allow a PhysiCVE-2025-597044.6Entrust nShield Connect XC, nShield 5c, and nShield HSMi through 13.6.11, or 13.7 (patched in 13.6.12 (LTS) and 13.9.0 (STS)), allow an attaCVE-2025-597056.8Entrust nShield Connect XC, nShield 5c, and nShield HSMi through 13.6.11, or 13.7 (patched in 13.6.12 (LTS) and 13.9.0 (STS)), allow a PhysiCVE-2025-597069.8In N2W before 4.3.2 and 4.4.0 before 4.4.1, improper validation of API request parameters enables remote code execution.CVE-2025-597079.8In N2W before 4.3.2 and 4.4.x before 4.4.1, there is potential remote code execution and account credentials theft because of a spoofing vulCVE-2025-597096.8An issue was discovered in Biztalk360 through 11.5. because of mishandling of user-provided input in a path to be read by the server, a SupeCVE-2025-59718.8A vulnerability was found in code-projects School Fees Payment System 1.0. It has been classified as critical. This affects an unknown part CVE-2025-597108.8An issue was discovered in Biztalk360 before 11.5. Because of incorrect access control, any user is able to request the loading a DLL file. CVE-2025-597118.3An issue was discovered in Biztalk360 before 11.5. Because of mishandling of user-provided input in an upload mechanism, an authenticated atCVE-2025-597125.4Snipe-IT before 8.1.18 allows XSS.CVE-2025-597138.1Snipe-IT before 8.1.18 allows unsafe deserialization.CVE-2025-597144.9In Internet2 Grouper 5.17.1 before 5.20.5, group admins who are not Grouper sysadmins can configure loader jobs.