CryptoPro Secure Disk CVE-2025-59327

Exploitation requires all of the following: (1) the target system must have CPSD CryptoPro Secure Disk for BitLocker version prior to v7.7.4 installed as its pre-boot authentication component; (2) an attacker must be able to introduce a LUKS-encrypted volume into the system's boot device enumeration - this is achievable via physical attachment of a LUKS-formatted USB or disk, remote mounting of a LUKS image through an out-of-band management interface (BMC/IPMI/iDRAC virtual media), or OS-level compromise with the ability to configure and reboot to a LUKS device; (3) the LUKS volume must be present and detectable by bootxsa.efi during its execution phase. Once these conditions are met, the bypass is automatic - no further attacker interaction is required. The NVD CVSS AV:N/PR:N rating is inconsistent with this attack surface and should not be relied upon. What limits exploitation in practice: the product is niche with low deployment prevalence, physical or management-plane access is required, and no ready-made public exploit has been identified beyond the research disclosure.

The NVD-assigned CVSS vector (AV:N/AC:L/PR:N/UI:N) implies remote, unauthenticated, low-complexity exploitation - a characterization that is highly inconsistent with a UEFI bootloader attack surface. Bootloader components execute before OS networking stacks are initialized; realistic exploitation requires physical device access, access to an out-of-band management interface (BMC, iDRAC, iLO, IPMI) capable of mounting virtual media, or OS-level privilege with the ability to reboot and inject a LUKS-formatted disk image. The NVD CVSS vector is assessed as likely miscategorized and should not be used as the basis for risk triage. The EPSS score of 0.11% at the 1st percentile supports low automated or opportunistic exploitation probability, consistent with a niche product and an attack requiring physical proximity or privileged infrastructure access. There is no CISA KEV listing. The Black Hat USA 2026 disclosure ('The Cost of Obscurity,' Burch) does elevate risk for targeted scenarios: nation-state and advanced persistent threat actors targeting encrypted laptop fleets or high-security endpoints now have public research to build from. For organizations not running this specific product, risk is zero.

An attacker with physical access to a laptop protected by CryptoPro Secure Disk for BitLocker attaches a LUKS-formatted USB drive before system power-on. When bootxsa.efi executes, it detects the LUKS volume and enters the flawed code path, bypassing all CryptoPro file integrity checks. The attacker's pre-staged tampered boot binary - which would normally fail integrity verification - loads and executes, granting access to BitLocker key material or establishing a persistent pre-OS backdoor. The Black Hat USA 2026 whitepaper by Burch provides research-grade technical detail that materially aids exploit construction.