CVE-2025-59697: Entrust nShield privilege escalation via GRUB bootloader configuration

CVE-2025-59697 · Severity: high · CVSS 7.2 · Published 2025-12-02

Entrust nShield hardware security modules (HSMs) are devices that manage cryptographic keys and perform security-critical operations for enterprises. An attacker with physical access to these devices can modify the GRUB bootloader configuration to execute a root shell at startup, gaining complete control of the HSM and compromising all cryptographic operations and stored keys. This vulnerability puts enterprise cryptographic infrastructure at severe risk if the device is accessible to unauthorized personnel.

Technologies: Entrust nShield Connect XC, Entrust Nshield 5c, Entrust Nshield Hsmi. Vendors: Entrust.

Quick answers

Is CVE-2025-59697 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2025-59697 being exploited in the wild.
How severe is CVE-2025-59697?
High severity, with a CVSS score of 7.2, published 2 December 2025.
Which products and versions are affected?
Entrust nShield Connect XC through 13.6.11, or 13.7 (patched in 13.6.12 LTS and 13.9.0 STS); Entrust Nshield 5c through 13.6.11, or 13.7 (patched in 13.6.12 LTS and 13.9.0 STS); Entrust Nshield Hsmi through 13.6.11, or 13.7 (patched in 13.6.12 LTS and 13.9.0 STS).
Is there a fix for CVE-2025-59697?
A patch was published on 2025: Patched in 13.6.12 (LTS) and 13.9.0 (STS) Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-59697 attacked?
It is attacked with physical access.
Am I affected by CVE-2025-59697?
Check whether you run Entrust nShield Connect XC, Entrust Nshield 5c or Entrust Nshield Hsmi at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

This vulnerability stems from improper privilege management in the boot chain protection of nShield HSM devices. An attacker with physical proximity and high privileges (administrative access to the device or ability to modify bootloader configurations) can edit the Legacy GRUB bootloader configuration to execute arbitrary commands with root privileges during system boot. The attack does not require network access (physical attack vector only) and does not require user interaction once bootloader access is obtained. Successful exploitation grants the attacker root-level control over the HSM, enabling compromise of cryptographic operations, key theft, and persistent backdoors. Patches are available in version 13.6.12 (LTS) and 13.9.0 (STS); versions through 13.6.11 and 13.7 are affected.

Affected products

  • Entrust nShield Connect XC through 13.6.11, or 13.7 (patched in 13.6.12 LTS and 13.9.0 STS)
  • Entrust nShield 5c through 13.6.11, or 13.7 (patched in 13.6.12 LTS and 13.9.0 STS)
  • Entrust nShield HSMi through 13.6.11, or 13.7 (patched in 13.6.12 LTS and 13.9.0 STS)

Timeline

  • 2025-09-22: disclosed: Google security research disclosed multiple vulnerabilities including F06
  • 2025-12-02: advisory: CVE-2025-59697 published by NVD
  • 2025: patched: Patched in 13.6.12 (LTS) and 13.9.0 (STS)

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.