CVE-2025-59697: High severity Entrust nShield Connect XC vulnerability
Entrust nShield Connect XC, nShield 5c, and nShield HSMi through 13.6.11, or 13.7 (patched in 13.6.12 (LTS) and 13.9.0 (STS)), allow a physically proximate attacker to escalate privileges by editing the Legacy GRUB bootloader configuration to start a root shell upon boot of the host OS. This is called F06.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Entrust nShield Connect XC, nShield 5c, nShield HSMito a version that resolves this vulnerability.Fixed in 13.6.12 - Upgrade
Upgrade
Entrust nShield Connect XC, nShield 5c, nShield HSMito a version that resolves this vulnerability.Fixed in 13.9.0 - Compensating control
Mitigate the F06 bootloader-edit privilege-escalation by preventing an attacker from physically accessing and editing the Legacy GRUB bootloader configuration on the host (e.g., secure/lock the host console/boot path so only authorized personnel can change bootloader settings).
Event History
Frequently Asked Questions
What is the severity of CVE-2025-59697?
CVE-2025-59697 is considered a high severity vulnerability due to the potential for privilege escalation by a physically proximate attacker.
How do I fix CVE-2025-59697?
To mitigate CVE-2025-59697, it's crucial to update your Entrust nShield Connect XC, nShield 5c, and nShield HSMi devices to the latest firmware version beyond 13.7.
Who is affected by CVE-2025-59697?
CVE-2025-59697 affects users of Entrust nShield Connect XC, nShield 5c, and nShield HSMi devices running versions up to and including 13.6.11 or beginning from version 13.7.
What kind of attack does CVE-2025-59697 enable?
CVE-2025-59697 enables an attacker with physical access to escalate privileges by modifying the bootloader configuration to launch a root shell.
What should I do if I cannot update my software to address CVE-2025-59697?
If updating is not possible for CVE-2025-59697, consider restricting physical access to the devices to minimize the risk of exploitation.