BaseFortify

Publication date: 2025-12-02

Last updated on: 2025-12-08

Assigner: MITRE

Description

Entrust nShield Connect XC, nShield 5c, and nShield HSMi through 13.6.11, or 13.7, allow a physically proximate attacker to escalate privileges by booting from a USB device with a valid root filesystem. This occurs because of insecure default settings in the Legacy GRUB Bootloader.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-12-02

Last Modified

2025-12-08

Generated

2026-07-06

AI Q&A

2025-12-02

EPSS Evaluated

2026-07-05

NVD

CVE-2025-59699

Affected Vendors & Products

Vendor	Product	Version / Range
entrust	nshield_5c_firmware	From 13.7 (inc) to 13.9.0 (inc)
entrust	nshield_5c_firmware	From 13.7 (inc) to 13.9.0 (inc)
entrust	nshield_5c	*
entrust	nshield_hsmi	*
entrust	nshield_connect_xc_base	*
entrust	nshield_connect_xc_mid_firmware	From 13.7 (inc) to 13.9.0 (inc)
entrust	nshield_connect_xc_mid	*
entrust	nshield_connect_xc_high_firmware	From 13.7 (inc) to 13.9.0 (inc)
entrust	nshield_connect_xc_high_firmware	From 13.7 (inc) to 13.9.0 (inc)
entrust	nshield_connect_xc_high	*
entrust	nshield_hsmi_firmware	From 13.7 (inc) to 13.9.0 (inc)
entrust	nshield_connect_xc_base_firmware	From 13.7 (inc) to 13.9.0 (inc)
entrust	nshield_hsmi_firmware	From 13.7 (inc) to 13.9.0 (inc)
entrust	nshield_connect_xc_base_firmware	From 13.7 (inc) to 13.9.0 (inc)
entrust	nshield_connect_xc_mid_firmware	From 13.7 (inc) to 13.9.0 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-290	This attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks.

Attack-Flow Graph

Executive Summary

This vulnerability affects Entrust nShield Connect XC, nShield 5c, and nShield HSMi devices up to versions 13.6.11 and 13.7. It allows an attacker who is physically close to the device to escalate their privileges by booting the device from a USB device that contains a valid root filesystem. The root cause is insecure default settings in the Legacy GRUB Bootloader, which permits this unauthorized boot process.

Impact Analysis

An attacker with physical access to the affected devices can gain elevated privileges by booting from a malicious USB device. This could lead to unauthorized control over the device, potentially compromising sensitive cryptographic operations or data protected by the Entrust nShield hardware security modules.

Hi! I’m here to help you understand CVE-2025-59699. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70