CVE-2025-59705: Entrust Nshield 5c Privilege Escalation Flaw

CVE-2025-59705 Overview

CVE-2025-59705 is a privilege escalation vulnerability affecting Entrust nShield Connect XC, nShield 5c, and nShield HSMi hardware security modules (HSMs) running firmware through 13.6.11, or 13.7. The flaw, tracked internally as F01 ("Unauthorized Reactivation of the USB interface"), allows a physically proximate attacker to re-enable the USB interface by inserting a chassis probe during system boot. Successful exploitation grants elevated access to a device designed to protect cryptographic keys. Entrust addressed the issue in firmware 13.6.12 (LTS) and 13.9.0 (STS). The weakness is categorized under CWE-269: Improper Privilege Management.

Critical Impact
An attacker with physical access to the HSM chassis during boot can reactivate the USB interface and escalate privileges, undermining the confidentiality, integrity, and availability guarantees of the device.

Affected Products

Entrust nShield Connect XC (Base, Mid, High) firmware through 13.6.11 and 13.7
Entrust nShield 5c firmware through 13.6.11 and 13.7
Entrust nShield HSMi firmware through 13.6.11 and 13.7

Discovery Timeline

2025-12-02 - CVE-2025-59705 published to the National Vulnerability Database (NVD)
2026-08-26 - Entry last modified in NVD

Technical Details for CVE-2025-59705

Vulnerability Analysis

The vulnerability resides in the boot-time handling of the nShield USB interface. Under normal operation, the USB interface is disabled on these HSM product lines to limit the physical attack surface. The firmware fails to enforce that disabled state when a chassis probe is inserted during the system boot sequence. The probe triggers a code path that reactivates the USB interface before access controls are fully established. Once the USB interface is live, the attacker gains a privileged channel into the device that is not available during normal operation. Because nShield HSMs store cryptographic key material and perform signing, encryption, and attestation operations, unauthorized access at this layer can be leveraged to subvert dependent public key infrastructure (PKI), code signing, and transaction authorization workflows.

Root Cause

The root cause is improper privilege management [CWE-269] in the firmware's boot sequence. The firmware does not consistently honor the administrative state of the USB interface when hardware events on the chassis probe path occur early in boot. This design oversight permits a physical signal to override a software-enforced security configuration.

Attack Vector

Exploitation requires physical proximity to the HSM. The attacker must open or otherwise access the appliance chassis and insert a probe while the device is booting. No credentials, user interaction, or network reachability are required. The attack is constrained to adversaries who can bypass the operational physical controls surrounding the HSM, such as tamper-evident racks, locked cages, or data center access controls.

No public exploit code or proof-of-concept has been published for this issue. Technical details are described in the GitHub Security Advisory GHSA-6q4x-m86j-gfwj and the Entrust nShield Security Advisory.

Detection Methods for CVE-2025-59705

Indicators of Compromise

Tamper-evident seals on the HSM chassis that are broken, missing, or show signs of manipulation.
Unexpected USB device enumeration events in HSM audit logs after a reboot or power cycle.
Unscheduled reboots or power events on nShield appliances not correlated with change management records.
Physical access log entries for data center or server cage access that do not map to approved maintenance activity.

Detection Strategies

Review nShield audit logs for entries indicating USB interface state transitions, especially around boot events.
Correlate HSM boot and interface events with badge access, camera footage, and rack intrusion sensors.
Perform periodic physical inspection of chassis integrity and tamper indicators as part of HSM operational procedures.

Monitoring Recommendations

Forward HSM audit and syslog output to a centralized log platform and alert on reboot or interface change events.
Monitor environmental and tamper sensors on the racks housing nShield appliances.
Track firmware versions across the HSM fleet and alert on devices still running affected releases (through 13.6.11 or 13.7).

How to Mitigate CVE-2025-59705

Immediate Actions Required

Upgrade affected nShield Connect XC, nShield 5c, and nShield HSMi devices to firmware 13.6.12 (LTS) or 13.9.0 (STS).
Verify the physical integrity of each HSM chassis and replace tamper-evident seals as part of the upgrade process.
Audit physical access controls, logs, and video for the period during which affected firmware was in production.
Rotate any high-value keys where unauthorized physical access to the HSM cannot be ruled out.

Patch Information

Entrust has released fixed firmware in versions 13.6.12 (LTS) and 13.9.0 (STS). Customers running 13.6.11 or earlier on the LTS branch, or 13.7 on the STS branch, must upgrade. Refer to the Entrust nShield Security Advisory for firmware acquisition instructions and release notes, and to the GitHub Security Advisory for coordinated disclosure details.

Workarounds

Enforce strict physical access controls: locked cages, badge-based entry, and continuous video surveillance for HSM locations.
Deploy tamper-evident seals on chassis fasteners and inspect them on a defined schedule.
Restrict HSM maintenance to two-person integrity procedures and log all physical interactions with the device.
Treat any unexplained reboot of an unpatched HSM as a potential tamper event pending investigation.

bash

# Verify installed nShield firmware version before and after upgrade
enquiry | grep -i version

# After upgrading, confirm the device reports 13.6.12 (LTS) or 13.9.0 (STS) or later