EUVD-2025-210711
GHSA-5vmp-mmw3-vwr3
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Physical disk access is required to prepend a partition; no credentials on the target OS are needed since the attack occurs before OS boot.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
4DescriptionCVE.org
CPSD CryptoPro Secure Disk for Bitlocker before v7.7.4 fails to certify the integrity of the intended boot partition and selects the first partition index matching a hardcoded type value. A crafted Linux partition could be inserted ahead of this intended target, allowing for code execution in the context of high privilege.
AnalysisAI
Boot partition authentication bypass in CPSD CryptoPro Secure Disk for BitLocker before v7.7.4 allows an attacker who can manipulate disk partition layout to redirect boot-time code execution to a crafted Linux partition. The product fails to cryptographically verify the integrity of the intended boot partition and instead selects the first partition whose type matches a hardcoded value - a logic flaw that allows a spoofed partition to preempt the legitimate boot target and execute arbitrary code at elevated privilege. No public exploit or CISA KEV listing is confirmed at time of analysis, though a Black Hat USA 2026 research presentation by Burch ('The Cost of Obscurity') describes the finding, suggesting detailed technical disclosure has occurred.
Technical ContextAI
CryptoPro Secure Disk for BitLocker is a pre-boot authentication and disk encryption management product by Austrian vendor CPSD (cpsd.at). The vulnerability stems from a partition selection algorithm at boot time that identifies the target partition by matching its type field against a hardcoded value rather than verifying a cryptographic identity or integrity measure - a classic CWE-290 (Authentication Bypass by Spoofing) pattern. Because the selector uses only the partition type byte/GUID and picks the first matching entry in the partition table, an adversary who can prepend a crafted Linux partition with the same type value ahead of the intended Windows/BitLocker partition causes the bootloader to execute code from the attacker-controlled partition instead. The CPE data provided is non-specific (cpe:2.3:a:n/a:n/a), indicating NVD has not yet assigned a normalized CPE string; affected product is confirmed by vendor advisory at cpsd.at and the fix version is v7.7.4.
RemediationAI
Upgrade to CPSD CryptoPro Secure Disk for BitLocker v7.7.4 or later - this is the vendor-confirmed fix per the CVE description and advisory at https://www.cpsd.at/blog/. Until the patch is applied, restrict physical access to affected endpoints to trusted personnel only, as the attack requires local disk manipulation. Deploying UEFI Secure Boot with strict signature enforcement may raise the bar for booting attacker-controlled partition content, though this does not address the root partition-selection logic flaw. Organizations should also verify that pre-boot environment integrity measurements (TPM PCR values) are configured to detect partition table changes, which would cause BitLocker to withhold the encryption key on tamper - this acts as a compensating control but may cause availability impact (requiring recovery key entry). Disabling the ability to boot from external media in firmware settings limits one avenue for partition table manipulation.
LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutContr
Reachable assertion in Open5GS up to version 2.7.6 allows remote unauthenticated attackers to crash the Diameter CER han
A Command Injection issue in the payload build page in BYOB (Build Your Own Botnet) 2.0 allows attackers to execute arbi
Denial of service in Open5GS 2.7.6 and earlier allows network-adjacent attackers with low-privilege Diameter Gx peer acc
Denial of service in Open5GS HSS (Home Subscriber Server) versions 2.7.0 through 2.7.6 is triggered remotely by manipula
Remote command injection in Control Web Panel allows unauthenticated attackers to execute arbitrary OS commands as root
LINQPad before 5.52.01 Pro edition is vulnerable to Unsafe Deserialization in LINQPad.AutoRefManager::PopulateFromCache(
Remote code execution in dash-uploader (Python package for Plotly Dash) versions 0.1.0 through 0.7.0a2 allows unauthenti
Command injection in LiteLLM 1.18.10 lets attackers who can configure MCP (Model Context Protocol) servers supply arbitr
SQL injection in AzuraCast's backup restore flow (versions up to and including 0.23.7) lets an attacker achieve privileg
Arbitrary file read in Yu AI Code Mother v4.3 lets anonymous, remote attackers retrieve files outside the intended previ
Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali
Same weakness CWE-290 – Authentication Bypass by Spoofing
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today