CVE-2025-10010
📋 TL;DR
CVE-2025-10010 is a configuration file integrity bypass vulnerability in CryptoPro Secure Disk (CPSD) that allows attackers with physical access to modify unvalidated Linux configuration files. This enables arbitrary code execution as root during the pre-boot authentication phase, potentially compromising the entire Windows BitLocker encryption system. Organizations using CPSD for disk encryption are affected.
💻 Affected Systems
- CryptoPro Secure Disk (CPSD)
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise where attackers install persistent backdoors, capture encryption keys, and access all encrypted data while bypassing authentication mechanisms.
Likely Case
Attackers with brief physical access modify configuration files to capture credentials or encryption keys, leading to data exfiltration from encrypted drives.
If Mitigated
With proper physical security controls and monitoring, attackers cannot access systems physically, preventing exploitation entirely.
🎯 Exploit Status
Exploitation requires physical access to modify files on the unencrypted Linux partition, but no authentication is needed once physical access is obtained.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown - check vendor advisory
Vendor Advisory: https://r.sec-consult.com/cpsd
Restart Required: Yes
Instructions:
1. Monitor vendor website for security updates. 2. Apply patches when available. 3. Reboot systems after patching.
🔧 Temporary Workarounds
Physical Security Enhancement
allStrengthen physical access controls to prevent unauthorized access to devices
Disk Removal Monitoring
allImplement monitoring for unauthorized physical removal or tampering with storage devices
🧯 If You Can't Patch
- Implement strict physical security controls including locked cabinets, access logs, and surveillance for all devices using CPSD.
- Consider alternative full-disk encryption solutions that don't have this vulnerability while waiting for patches.
🔍 How to Verify
Check if Vulnerable:
Check if CPSD is installed and review the Linux pre-boot partition for IMA configuration file validation gaps.Check Version:
Check CPSD version through vendor documentation or installed application information.Verify Fix Applied:
After vendor patch, verify that configuration files are now included in IMA measurement and validation checks.📡 Detection & Monitoring
Log Indicators:
- Unexpected modifications to Linux pre-boot partition files
- IMA measurement failures for configuration files
- Authentication anomalies during pre-boot phase
Network Indicators:
- No network indicators - physical access required
SIEM Query:
Search for file modification events on CPSD Linux partition or IMA measurement failures