CVE-2025-59704

MediumCVSS 4.6/10Last modified Aug 26, 2026

Description

Entrust nShield Connect XC, nShield 5c, and nShield HSMi through 13.6.11, or 13.7 (patched in 13.6.12 (LTS) and 13.9.0 (STS)), allow an attacker to gain access the the BIOS menu because is has no password.

Metrics

CVSS 3.1 4.6/10CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-287

Affected software

No affected versions have been published.

Timeline

Published: Dec 2, 2025
Last modified: Aug 26, 2026
NVD status: Modified

Related CVEs from 2025

CVE-2025-597056.8Entrust nShield Connect XC, nShield 5c, and nShield HSMi through 13.6.11, or 13.7 (patched in 13.6.12 (LTS) and 13.9.0 (STS)), allow a Physi CVE-2025-597069.8In N2W before 4.3.2 and 4.4.0 before 4.4.1, improper validation of API request parameters enables remote code execution.CVE-2025-597079.8In N2W before 4.3.2 and 4.4.x before 4.4.1, there is potential remote code execution and account credentials theft because of a spoofing vul CVE-2025-597096.8An issue was discovered in Biztalk360 through 11.5. because of mishandling of user-provided input in a path to be read by the server, a Supe CVE-2025-59718.8A vulnerability was found in code-projects School Fees Payment System 1.0. It has been classified as critical. This affects an unknown part CVE-2025-597108.8An issue was discovered in Biztalk360 before 11.5. Because of incorrect access control, any user is able to request the loading a DLL file. CVE-2025-597118.3An issue was discovered in Biztalk360 before 11.5. Because of mishandling of user-provided input in an upload mechanism, an authenticated at CVE-2025-597125.4Snipe-IT before 8.1.18 allows XSS.CVE-2025-597138.1Snipe-IT before 8.1.18 allows unsafe deserialization.CVE-2025-597144.9In Internet2 Grouper 5.17.1 before 5.20.5, group admins who are not Grouper sysadmins can configure loader jobs.CVE-2025-597155.4SMSEagle before 6.11 allows reflected XSS via a username or contact phone number.CVE-2025-597165.3ownCloud Guests before 0.12.5 allows unauthenticated user enumeration via the /apps/guests/register/{email}/{token} endpoint. Because of ins