CVE-2025-59699: Medium severity Entrust nShield Connect XC vulnerability
Entrust nShield Connect XC, nShield 5c, and nShield HSMi through 13.6.11, or 13.7 (patched in 13.6.12 (LTS) and 13.9.0 (STS)), allow a physically proximate attacker to escalate privileges by booting from a USB device with a valid root filesystem. This occurs because of insecure default settings in the Legacy GRUB Bootloader.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Entrust nShield Connect XC, nShield 5c, and nShield HSMito a version that resolves this vulnerability.Fixed in 13.6.12 - Upgrade
Upgrade
Entrust nShield Connect XC, nShield 5c, and nShield HSMito a version that resolves this vulnerability.Fixed in 13.9.0 - Configuration
Change the Legacy GRUB Bootloader configuration from the insecure defaults to prevent booting from a physically proximate attacker's USB device with a valid root filesystem.
Legacy GRUB Bootloader insecure default settings = secure/updated configuration
Event History
Frequently Asked Questions
What is the severity of CVE-2025-59699?
CVE-2025-59699 is considered a high-severity vulnerability due to the potential for privilege escalation by a physically proximate attacker.
How do I fix CVE-2025-59699?
To mitigate CVE-2025-59699, ensure that the Legacy GRUB Bootloader is securely configured to prevent booting from unauthorized USB devices.
Who is affected by CVE-2025-59699?
CVE-2025-59699 affects Entrust nShield Connect XC, nShield 5c, and nShield HSMi devices running versions up to and including 13.6.11 and 13.7.
What type of attacker can exploit CVE-2025-59699?
CVE-2025-59699 can be exploited by a physically proximate attacker with access to the device.
What causes the vulnerability in CVE-2025-59699?
The vulnerability in CVE-2025-59699 arises from insecure default settings in the Legacy GRUB Bootloader, allowing unauthorized access if exploited.