PT-2025-27789 · Microsoft · Windows+1

Published 2025-07-03 · Updated 2025-07-03 · CVE-2025-27460

Positive Technologies (AI Summary)

CVSS v3.1

7.6

High

Base vector

AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Windows (affected versions not specified)

Description: The issue concerns the lack of full volume encryption on device hard drives, such as BitLocker. This allows an attacker with physical access to the device to use an alternative operating system, bypassing the Windows login and enabling them to read from and write to all files on the hard drives.

Recommendations: For Windows, enable full volume encryption using a feature like BitLocker to protect data on the hard drives. As a temporary workaround, consider using alternative encryption methods or physically securing devices to minimize the risk of unauthorized access.

Fix

Inadequate Encryption Strength

Cleartext Storage of Sensitive Information

Weakness Enumeration

CWE-326

CWE-312

Related Identifiers

BDU:2025-10434

CVE-2025-27460

Affected Products

Bitlocker

Windows

References · 11

• https://sick.com/psirt · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-10434 · Security Note
• https://sick.com/.well-known/csaf/white/2025/sca-2025-0008.pdf · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-27460 · Security Note
• https://sick.com/.well-known/csaf/white/2025/sca-2025-0008.json · Vendor Advisory
• https://first.org/cvss/calculator/3.1 · Note
• https://twitter.com/CVEnew/status/1940740038578385039 · Twitter Post
• https://endress.com · Note
• https://cisa.gov/resources-tools/resources/ics-recommended-practices · Note
• https://twitter.com/VulmonFeeds/status/1940844882207096836 · Twitter Post
• https://sick.com/de/en/service-and-support/the-sick-product-security-incident-response-team-sick-psirt/w/psirt · Note