CVE-2025-59698: Entrust Nshield 5c Firmware Privilege Escalation

CVE-2025-59698 Overview

CVE-2025-59698 affects Entrust nShield Connect XC, nShield 5c, and nShield HSMi hardware security modules (HSMs) running firmware through version 13.6.11 or 13.7. The flaw allows a physically proximate attacker to gain access to the end-of-life legacy bootloader on affected devices. The weakness is classified under CWE-1270: Generation of Incorrect Security Tokens, covering internal asset protection failures. Entrust addressed the issue in firmware 13.6.12 (LTS) and 13.9.0 (STS). HSMs anchor cryptographic trust for payment systems, PKI, and key management, so bootloader exposure undermines the device's hardware root of trust assumptions.

Critical Impact
An attacker with physical access can reach the legacy bootloader on affected nShield HSMs, exposing confidentiality, integrity, and availability of cryptographic operations the device protects.

Affected Products

Entrust nShield Connect XC (Base, Mid, High) firmware through 13.6.11 and 13.7
Entrust nShield 5c firmware through 13.6.11 and 13.7
Entrust nShield HSMi firmware through 13.6.11 and 13.7

Discovery Timeline

2025-12-02 - CVE CVE-2025-59698 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2025-59698

Vulnerability Analysis

The vulnerability resides in the boot chain of affected nShield HSM models. Firmware revisions through 13.6.11 and the 13.7 branch retain reachable code paths to a legacy bootloader that reached end-of-life status. A physically proximate attacker can leverage these paths to execute or interact with bootloader-level code the vendor intended to retire. Because the bootloader runs below the signed firmware runtime, access at this layer undermines the device's secure boot assumptions and the integrity of downstream cryptographic services. The CWE-1270 classification reflects the device's inability to enforce the expected generation and handling of internal security tokens across boot stages.

Root Cause

The root cause is the retention of an end-of-life legacy bootloader component in production firmware images. Rather than being removed or hard-disabled, the legacy stage remains invocable on the hardware. This leaves the HSM with a redundant boot path that lacks the hardening applied to current bootloader revisions. Entrust's September 2025 advisory confirms the fix removes or restricts this path in supported LTS and STS branches.

Attack Vector

Exploitation requires physical proximity to the HSM appliance. This typically means direct console, serial, or chassis-level access inside a data center or secure facility. No authentication or user interaction is required once physical access is achieved. The practical risk model therefore centers on supply chain interception, insider threat, and physical facility compromise rather than remote network attacks. For technical specifics, see the Google Security Advisory GHSA-6q4x-m86j-gfwj and the Entrust nShield Advisory September 2025.

No public proof-of-concept code is available. The vulnerability mechanism is described in prose by the referenced advisories.

Detection Methods for CVE-2025-59698

Indicators of Compromise

Unexpected HSM reboots, firmware version mismatches, or boot stage transitions logged by the appliance.
Physical tamper indicators on nShield chassis, including seal breaks or unexpected console/serial connections.
Audit log gaps or administrative sessions originating from local console interfaces outside maintenance windows.

Detection Strategies

Inventory all nShield Connect XC, nShield 5c, and nShield HSMi units and compare firmware revisions against the fixed releases 13.6.12 (LTS) and 13.9.0 (STS).
Forward HSM syslog and audit telemetry to a centralized SIEM and alert on boot events, firmware integrity failures, and local administrative actions.
Correlate HSM physical access with badge-reader, CCTV, and data center access logs to identify unauthorized proximity events.

Monitoring Recommendations

Continuously monitor HSM firmware version drift and generate alerts when unmanaged downgrades or unsigned boot stages are observed.
Track physical access to HSM racks with environmental sensors and surveillance, retaining logs long enough for incident reconstruction.
Review Security Worlds, card set usage, and key operations for anomalies that could follow a bootloader-level compromise.

How to Mitigate CVE-2025-59698

Immediate Actions Required

Upgrade affected nShield Connect XC, nShield 5c, and nShield HSMi units to firmware 13.6.12 (LTS) or 13.9.0 (STS) as published by Entrust.
Restrict physical access to HSM appliances to a minimal, named list of personnel and enforce dual control for maintenance.
Validate chassis tamper evidence and remove or disable unused console and serial interfaces where supported.

Patch Information

Entrust released fixes in firmware 13.6.12 on the Long Term Support branch and 13.9.0 on the Short Term Support branch. Patch guidance and supporting detail are published in the Entrust nShield Advisory September 2025 and tracked in the GitHub Security Advisory GHSA-cjjw-86jv-h24c. Apply the upgrade through the standard nShield firmware update procedure and verify the running image after reboot.

Workarounds

Enforce strict physical security controls, including locked racks, tamper-evident seals, and continuous surveillance, until firmware upgrades are complete.
Reduce HSM exposure by relocating affected units to higher-assurance zones and limiting console cable availability.
Rotate cryptographic material and review Security World membership if unauthorized physical access to an affected unit is suspected.

bash

# Verify running firmware on nShield appliances and plan upgrades
enquiry | grep -i version
# Expected after patching: 13.6.12 (LTS) or 13.9.0 (STS) or later