High · published December 2, 2025
⚡ If a physically close attacker can reconfigure the bootloader, they can turn your system into their playground! 🔥 Think of it like a hotel guest who can gain access to the master control for all rooms — they can unlock any door! In this case, editing the Legacy GRUB configuration is akin to changing the locks to give themselves root access on your system. An attacker with physical access can escalate privileges and start a root shell at boot. This means they could take full control of the system, access sensitive data, install malicious software, or even manipulate security measures. The possibilities are concerning!
Think of it like a hotel guest who can gain access to the master control for all rooms — they can unlock any door! In this case, editing the Legacy GRUB configuration is akin to changing the locks to give themselves root access on your system. This vulnerability allows a physically proximate attacker to modify the bootloader configuration of Entrust nShield Connect XC, nShield 5c, and nShield HSMi to initiate a root shell upon boot, which bypasses normal security measures.
An attacker with physical access can escalate privileges and start a root shell at boot. This means they could take full control of the system, access sensitive data, install malicious software, or even manipulate security measures. The possibilities are concerning! To protect against this vulnerability, ensure that physical access to the devices is strictly controlled. Additionally, consider patching to the latest version beyond 13.6.11 or 13.7. Regularly review and audit bootloader configurations to ensure they haven't been tampered with. You've got this! By securing physical access and updating your systems, you can keep those attackers at bay! 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| entrust/nshield_5c_firmware | < 13.6.12 | 13.6.12 |
| entrust/nshield_5c_firmware | ≥ 13.7, < 13.9.0 | 13.9.0 |
| entrust/nshield_hsmi_firmware | < 13.6.12 | 13.6.12 |
| entrust/nshield_hsmi_firmware | ≥ 13.7, < 13.9.0 | 13.9.0 |
| entrust/nshield_connect_xc_base_firmware | < 13.6.12 | 13.6.12 |
| entrust/nshield_connect_xc_base_firmware | ≥ 13.7, < 13.9.0 | 13.9.0 |
| entrust/nshield_connect_xc_mid_firmware | < 13.6.12 | 13.6.12 |
| entrust/nshield_connect_xc_mid_firmware | ≥ 13.7, < 13.9.0 | 13.9.0 |
| entrust/nshield_connect_xc_high_firmware | < 13.6.12 | 13.6.12 |
| entrust/nshield_connect_xc_high_firmware | ≥ 13.7, < 13.9.0 | 13.9.0 |