CVE-2025-59704: Entrust Nshield 5c Authentication Bypass

CVE-2025-59704 Overview

CVE-2025-59704 affects Entrust nShield Connect XC, nShield 5c, and nShield HSMi hardware security modules (HSMs) running firmware through 13.6.11, or 13.7. The BIOS menu on these appliances ships without a password, allowing an attacker with physical access to enter BIOS configuration and modify boot settings. Entrust patched the issue in firmware versions 13.6.12 (LTS) and 13.9.0 (STS). The weakness is tracked under [CWE-287] (Improper Authentication) and requires local physical access to the device.

Critical Impact
An attacker with physical access to the HSM can enter the BIOS menu without authentication and alter boot configuration, undermining the integrity guarantees expected of a certified cryptographic appliance.

Affected Products

Entrust nShield Connect XC (Base, Mid, High) firmware through 13.6.11 and 13.7
Entrust nShield 5c firmware through 13.6.11 and 13.7
Entrust nShield HSMi firmware through 13.6.11 and 13.7

Discovery Timeline

2025-12-02 - CVE CVE-2025-59704 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2025-59704

Vulnerability Analysis

The Entrust nShield product family provides FIPS-certified cryptographic operations, key storage, and root-of-trust services. On the affected appliances, the platform BIOS exposes an interactive setup menu that is not protected by a password. An attacker who reaches the device console during power-on can enter BIOS setup and change parameters such as boot device order, boot options, or firmware-level configuration.

Because an HSM's security model depends on strict control of the boot chain and firmware provenance, unauthenticated BIOS access breaks a foundational assumption. The vulnerability sits below the operating firmware, so software-level access controls on the HSM cannot compensate for it. Exploitation requires physical proximity and console access rather than network reachability.

Root Cause

The root cause is a missing authentication control on the BIOS setup interface, categorized under [CWE-287]. The shipped BIOS configuration does not enforce a supervisor or setup password, so any operator with physical access is treated as an authorized administrator of the firmware environment.

Attack Vector

Exploitation requires physical access to the HSM chassis, a keyboard, and a display connected to the appliance's console. During the power-on self-test, the attacker presses the BIOS entry key and reaches the setup interface without providing credentials. From there, changes to boot order or firmware settings can be used to affect device integrity. No exploit code is required, and no public proof-of-concept is currently listed.

Detection Methods for CVE-2025-59704

Indicators of Compromise

Unexpected reboots or power cycles of nShield appliances outside of maintenance windows.
Physical tamper-evident seal breakage, chassis intrusion alerts, or unlogged data center access to racks containing HSMs.
Firmware version, boot order, or BIOS configuration values that differ from the documented gold baseline.

Detection Strategies

Compare BIOS settings and firmware versions against a known-good baseline after any physical maintenance event.
Correlate data center badge access, KVM console usage, and rack camera footage with HSM uptime records to identify unauthorized console sessions.
Ingest HSM syslog and health telemetry into a centralized data lake and alert on unexpected restarts of nShield Connect XC, nShield 5c, or nShield HSMi devices.

Monitoring Recommendations

Enable and forward chassis intrusion and environmental sensor events from the HSM and its host rack.
Monitor Security World client logs for unexpected module state changes, re-enrollments, or key ceremony activity.
Track firmware and BIOS versions as configuration items in the asset inventory and alert on drift.

How to Mitigate CVE-2025-59704

Immediate Actions Required

Upgrade affected appliances to nShield firmware 13.6.12 (LTS) or 13.9.0 (STS) as documented in the Entrust Security Advisory.
After patching, set a BIOS supervisor password on each appliance and store it in a controlled secrets vault.
Verify tamper-evident seals and physical access logs for every affected HSM before returning it to production.

Patch Information

Entrust addressed CVE-2025-59704 in nShield firmware 13.6.12 (Long Term Support) and 13.9.0 (Short Term Support). Refer to the GitHub Security Advisory and the Google Security Research advisory for coordinated disclosure details.

Workarounds

Restrict physical access to HSMs using locked cages, dual-control access procedures, and continuous CCTV coverage.
Disconnect keyboards, monitors, and KVM cabling from HSMs during normal operation and only attach them under change control.
Apply tamper-evident seals across chassis screws and console ports, and audit them on a scheduled basis until firmware is upgraded.

bash

# Configuration example
# After upgrading firmware, enter BIOS setup and configure:
#   1. Set Supervisor Password
#   2. Disable boot from USB and external media
#   3. Lock boot order to the internal storage device
#   4. Save and exit, then verify settings via a fresh reboot