PT-2026-21741 · Cryptopro · Cpsd Cryptopro Secure Disk

Published 2026-02-24 · Updated 2026-02-25 · CVE-2025-10010

Positive Technologies (AI Summary)

CVSS v3.1

6.8

Medium

Base vector

AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions CPSD CryptoPro Secure Disk (affected versions not specified)

Description The CPSD CryptoPro Secure Disk application utilizes a small Linux operating system for user authentication prior to BitLocker decryption of the Windows partition. The Linux system resides on a separate, unencrypted partition accessible to anyone with hard disk access. Configuration files are not validated by the Integrity Measurement Architecture (IMA), allowing modification if not checked by other measures. This enables an attacker to execute arbitrary code with root privileges, potentially planting a backdoor and accessing data during execution.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-353

Related Identifiers

CVE-2025-10010

Affected Products

Cpsd Cryptopro Secure Disk

References · 6

• https://osv.dev/vulnerability/CVE-2025-10010 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-10010 · Security Note
• http://seclists.org/fulldisclosure/2026/Mar/0 · Note
• https://twitter.com/autumn_good_35/status/2026658530615492965 · Twitter Post
• https://r.sec-consult.com/cpsd · Note
• https://twitter.com/CVEnew/status/2026676471797002542 · Twitter Post