CVE-2025-59697: Entrust Nshield 5c Privilege Escalation

CVE-2025-59697 Overview

CVE-2025-59697 is a privilege escalation vulnerability affecting Entrust nShield Connect XC, nShield 5c, and nShield HSMi hardware security modules (HSMs) running firmware through version 13.6.11, or 13.7. A physically proximate attacker can edit the Legacy GRUB bootloader configuration to spawn a root shell during host OS boot. Entrust tracks this issue internally as F06. The weakness falls under improper privilege management [CWE-269] and impacts appliances that are used to safeguard cryptographic keys and perform sensitive cryptographic operations in enterprise and government environments.

Critical Impact
Physical access to an affected nShield HSM allows an attacker to obtain a root shell on the host operating system, undermining the integrity and confidentiality guarantees the appliance is deployed to provide.

Affected Products

Entrust nShield Connect XC (Base, Mid, High) firmware through 13.6.11 and 13.7
Entrust nShield 5c firmware through 13.6.11 and 13.7
Entrust nShield HSMi firmware through 13.6.11 and 13.7

Discovery Timeline

2025-12-02 - CVE-2025-59697 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-59697

Vulnerability Analysis

Entrust nShield appliances run a hardened host operating system that manages the cryptographic module. The affected firmware ships with the Legacy GRUB bootloader configured in a way that allows interactive editing of boot entries at power-on. An attacker with physical access can interrupt the boot sequence, modify kernel parameters, and instruct the init process to launch a root shell before normal service startup. Because the host OS mediates administrative access to the HSM appliance, root on the host provides an elevated position from which further attacks against configuration, logs, and management interfaces become feasible.

Root Cause

The root cause is an insecure bootloader configuration [CWE-269]. Legacy GRUB is not locked down with a password or with restrictions on editing boot entries, so the standard GRUB editing keys remain functional at the console. This permits appending parameters such as an alternate init binary to obtain a shell without authenticating to the operating system.

Attack Vector

Exploitation requires physical proximity to the HSM appliance and existing high privileges to reach the console, consistent with the CVSS Physical attack vector. An operator with rack access power-cycles the appliance, enters the GRUB menu, edits the selected boot entry, and boots into a root shell. No network path or remote exploitation is documented for this issue. Additional technical detail is available in the GitHub Security Advisory GHSA-6q4x-m86j-gfwj.

Detection Methods for CVE-2025-59697

Indicators of Compromise

Unexpected reboots or power cycles of nShield appliances recorded in facility power or KVM logs.
Console or serial sessions initiated outside of scheduled maintenance windows.
Gaps in HSM audit logs corresponding to a reboot event followed by administrative changes.
Modifications to /boot/grub configuration files or on-disk kernel command lines after a boot event.

Detection Strategies

Correlate physical access logs (badge readers, cage cameras, KVM/serial console access) with HSM reboot events.
Monitor HSM syslog and management server audit trails for boot-time anomalies, missing service startups, or user sessions that begin before normal login services are available.
Baseline expected boot durations and flag deviations that may indicate manual GRUB interaction.

Monitoring Recommendations

Forward HSM audit and system logs to a centralized SIEM and alert on reboots outside change windows.
Enable and review tamper-evident seals and environmental sensors on the appliance chassis.
Track firmware versions across the estate and alert on hosts still running versions through 13.6.11 or 13.7.

How to Mitigate CVE-2025-59697

Immediate Actions Required

Inventory all nShield Connect XC, nShield 5c, and nShield HSMi devices and record current firmware versions.
Restrict physical access to HSM appliances to a minimal set of named operators, with mandatory dual control for console sessions.
Ensure appliances are installed in locked cabinets with tamper-evident seals and active surveillance.
Review recent physical access, reboot, and console activity for signs of exploitation.

Patch Information

Entrust has assigned this issue the internal identifier F06 for nShield firmware through 13.6.11 and 13.7. Consult Entrust support and the GitHub Security Advisory GHSA-6q4x-m86j-gfwj for fixed firmware releases and upgrade procedures specific to each appliance model. Follow Entrust guidance for signed firmware installation and key ceremony requirements when updating production HSMs.

Workarounds

Enforce strict physical security controls around HSM racks, including multi-factor entry and continuous video monitoring.
Disable or physically disconnect keyboard, video, and serial console interfaces when not required for maintenance.
Require dual-operator presence for any physical maintenance on nShield appliances and log all sessions.
Where supported by the platform, configure a GRUB password to prevent unauthenticated bootloader editing.

bash

# Example: adding a GRUB password on Legacy GRUB systems (reference only;
# apply only per Entrust-approved maintenance procedures for nShield appliances)
grub-md5-crypt
# then edit /boot/grub/menu.lst and add:
#   password --md5 <generated-hash>
#   lock