What is the CVSS score of CVE-2025-59324?

CVE-2025-59324 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.1%.

Which versions of CryptoPro Secure Disk are affected by CVE-2025-59324?

CPSD CryptoPro Secure Disk for Bitlocker versions before 7.7.4 contain a critical integrity-check bypass with no public exploit identified at time of analysis; the flaw permits attackers to tamper…

How to fix or mitigate CVE-2025-59324?

Within 24 hours, inventory all systems running CPSD CryptoPro Secure Disk versions prior to 7.7.4 and identify those with LUKS-encrypted volumes. Within 7 days, implement compensating controls including external file-integrity monitoring (AIDE, OSSEC), enhanced access controls, audit logging, and host-based intrusion detection for systems where this product is relied upon for security assurance. Within 30 days, monitor CPSD vendor communications for patch availability at v7.7.4 or later, and prepare a comprehensive testing and deployment plan for immediate rollout once released.

CryptoPro Secure Disk CVE-2025-59324

EUVD-2025-210713 CRITICAL

Improper Verification of Cryptographic Signature (CWE-347)

2026-08-12 mitre

GHSA-g8wr-64q9-3xm2

Information Disclosure Jwt Attack N A

9.1

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

vuln.today AI

6.2 MEDIUM

Integrity-check bypass on a disk-encryption product realistically needs local/physical access (AV:L) with no credentials (PR:N); impact is defeated file integrity (I:H), not confidentiality or availability.

3.1 AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

4.0 AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 13, 2026 - 16:26 vuln.today

CVSS changed

Aug 13, 2026 - 16:22 NVD

9.1 (CRITICAL)

CVE Published

Aug 12, 2026 - 00:00 cve.org

CRITICAL 9.1

CVE Published

Aug 12, 2026 - 00:00 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

CPSD CryptoPro Secure Disk for Bitlocker before v7.7.4 fails to properly validate LUKS encryption and, if encryption is present, all CryptoPro file integrity checks are skipped.

AnalysisAI

Integrity-check bypass in CPSD CryptoPro Secure Disk for Bitlocker before v7.7.4 lets an attacker defeat the product's file-integrity verification: when a LUKS-encrypted volume is present, the software fails to validate that encryption correctly and then silently skips ALL CryptoPro integrity checks, so tampered files pass as trusted. This undermines the pre-boot/endpoint trust guarantees the product exists to provide, enabling evil-maid-style tampering. There is no public exploit identified at time of analysis, though the flaw is the subject of a Black Hat USA 2026 disclosure ('The Cost of Obscurity'); EPSS is very low (0.11%, 1st percentile) and it is not on CISA KEV.

Technical ContextAI

CryptoPro Secure Disk for Bitlocker (CPSD, an Austrian vendor - cpsd.at) is a pre-boot authentication and endpoint full-disk-encryption management layer that wraps Microsoft BitLocker and can interoperate with LUKS (the Linux Unified Key Setup) encrypted volumes. The root cause maps to CWE-347 (Improper Verification of Cryptographic Signature): the product's integrity subsystem is supposed to cryptographically verify protected files, but the logic that detects LUKS encryption is flawed such that the mere presence of encryption causes the entire integrity-verification path to be short-circuited. In other words, an attribute an attacker can influence (encryption being 'present') acts as an implicit trust bypass rather than an additional control, so signed/measured integrity checks that should gate boot or file trust are never enforced. The provided CPE string (cpe:2.3:a:n/a:n/a:*) is a placeholder and carries no real product/version data.

RemediationAI

Primary fix: upgrade to CryptoPro Secure Disk for Bitlocker v7.7.4 or later (Vendor-released patch: v7.7.4), which is the version at which the LUKS-validation/integrity-skip defect is resolved; consult the vendor at https://www.cpsd.at/blog/ for release notes and https://nvd.nist.gov/vuln/detail/CVE-2025-59324 for the tracking record. Until patched, the meaningful compensating controls are physical and access-based rather than network: restrict and monitor physical access to endpoints running the product (locked enclosures, tamper-evident seals, secured boot order/BIOS passwords) so an attacker cannot present or manipulate a LUKS volume to trigger the integrity-check skip, and where feasible avoid LUKS-encrypted volume configurations on affected hosts since it is the presence of LUKS that triggers the bypass - the trade-off being reduced flexibility for mixed Linux/BitLocker fleets. Independently re-attest endpoint file integrity via an out-of-band mechanism (e.g., TPM measured boot / external integrity tooling) so you are not relying solely on CPSD's checks while unpatched.