PT-2026-21741 · Cryptopro · Cpsd Cryptopro Secure Disk

Publicado 2026-02-24 · Atualizado 2026-02-25 · CVE-2025-10010

Positive Technologies (AI Summary)

CVSS v3.1

6.8

Média

Vetor base

AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions CPSD CryptoPro Secure Disk (affected versions not specified)

Description The CPSD CryptoPro Secure Disk application utilizes a small Linux operating system for user authentication prior to BitLocker decryption of the Windows partition. The Linux system resides on a separate, unencrypted partition accessible to anyone with hard disk access. Configuration files are not validated by the Integrity Measurement Architecture (IMA), allowing modification if not checked by other measures. This enables an attacker to execute arbitrary code with root privileges, potentially planting a backdoor and accessing data during execution.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Enumeração de Fraquezas

CWE-353

Identificadores relacionados

CVE-2025-10010

Produtos afetados

Cpsd Cryptopro Secure Disk

Referências · 6

• http://seclists.org/fulldisclosure/2026/Mar/0 · Nota
• https://twitter.com/autumn_good_35/status/2026658530615492965 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2025-10010 · Aviso do Fabricante
• https://r.sec-consult.com/cpsd · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2025-10010 · Nota de Segurança
• https://twitter.com/CVEnew/status/2026676471797002542 · Publicação no Twitter