Entrust nShield Products Unauthenticated Firmware Modification Vulnerability on Chassis Management Board

A vulnerability exists in Entrust nShield Connect XC, nShield 5c, and nShield HSMi, all through version 13.6.11 or 13.7. This vulnerability allows a user with root access to the operating system to modify the firmware on the Chassis Management Board without authentication. The issue is categorized as F04.

Impact

Exploitation of this vulnerability allows for unauthorized firmware modifications on the Chassis Management Board, potentially leading to persistent and undetectable compromises of the affected hardware security module (HSM) appliance.

Reproduction

The vulnerability can be reproduced by gaining root access to the nShield appliance. Once root access is obtained, the 'cosmoupgrade' command can be used to upload modified firmware to the Cosmo board, bypassing any authentication requirements. This unverified firmware upgrade can be done remotely, taking advantage of the lack of secure boot protections.

Remediation

Users can upgrade to Entrust nShield versions 13.6.12 or 13.9.0 to address this vulnerability.