Security readout for executives and security teams
Plain-English summary
A person with physical access and existing high privileges could alter the legacy bootloader on affected Entrust nShield HSM appliances. After reboot, the device could start a root shell, potentially giving the attacker complete control of the host operating system and undermining the appliance’s security boundary.
Executive priority
Treat as a high-priority targeted-access issue, especially where HSMs protect business-critical cryptographic operations. Patch within the organization’s high-severity window and immediately tighten physical controls. Emergency internet-wide action is not indicated by the supplied evidence, but delayed remediation leaves a powerful privilege-escalation path for trusted or physically present attackers.
Technical view
CVE-2025-59697, designated F06, affects nShield Connect XC, nShield 5c, and nShield HSMi through 13.6.11, plus 13.7. Editing the Legacy GRUB configuration can launch a root shell during boot. CVSS 3.1 is 7.2, with physical access, low complexity, high privileges, no user interaction, changed scope, and high confidentiality, integrity, and availability impacts.
Likely exposure
Exposure is limited to the named nShield models and versions where an attacker can obtain physical proximity and high privileges. Internet reachability alone does not satisfy the stated attack conditions. Organizations should prioritize appliances in shared facilities, remote sites, or locations with weak physical-access controls.
Exploitation context
The supplied record does not establish active exploitation, and the CVE is not identified as CISA KEV. Exploitation requires physical proximity, high privileges, modification of Legacy GRUB configuration, and a reboot. These prerequisites reduce broad opportunistic risk but remain serious for targeted insider or facility-access scenarios.
Researcher notes
The weakness maps to CWE-269 and CWE-284. The changed-scope CVSS assessment reflects compromise extending beyond the vulnerable boot configuration into the host OS. The supplied evidence does not prove exposure of cryptographic keys, persistence details, exploitation in the wild, or whether additional product branches are affected; those conclusions require Entrust-specific investigation.
Mitigation direction
- Upgrade LTS deployments to 13.6.12 or a later vendor-supported fixed release.
- Upgrade STS deployments to 13.9.0 or a later vendor-supported fixed release.
- Restrict and monitor physical access to affected HSM appliances.
- Follow Entrust’s advisory for model-specific upgrade and integrity guidance.
Validation and detection
- Inventory nShield Connect XC, nShield 5c, and nShield HSMi appliances and firmware versions.
- Confirm LTS systems run 13.6.12 or later and STS systems run 13.9.0 or later.
- Review physical-access and maintenance records for unexpected appliance access.
- Check Legacy GRUB configuration for unauthorized changes using vendor-approved procedures.
- Verify upgraded appliances reboot normally and retain expected security controls.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-269: Authorization and privilege behavior lookup
Authorization weaknesses can support privilege escalation and valid-account review, depending on exploit path. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCWE-284: Authorization and privilege behavior lookup
Authorization weaknesses can support privilege escalation and valid-account review, depending on exploit path. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2025-59697 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.2 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:P/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:P/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H0.56CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
7.2HighVector: CVSS:3.1/AV:P/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://www.entrust.com/use-case/why-use-an-hsmCVE reference, mitre
- https://github.com/google/security-research/security/advisories/GHSA-6q4x-m86j-gfwjCVE reference, mitre
- https://www.entrust.com/knowledgebase/hardware/understanding-nshield-security-advisory-september-2025CVE reference, mitre
- https://github.com/advisories/GHSA-c2xm-xv33-q796CVE reference, mitre
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Privilege Management
Improper Privilege Management represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.
Improper Access Control
Improper Access Control represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.