CVE-2025-59320 Overview
CVE-2025-59320 affects CPSD CryptoPro Secure Disk for Bitlocker versions prior to v7.7.4. The product stores Trusted Platform Module (TPM) 2.0 secrets in a serialized format within unused disk sectors. An attacker with physical access to the system disk can recover these serialized secrets and reconstruct an environment capable of unsealing the TPM. The vulnerability is classified under [CWE-922: Insecure Storage of Sensitive Information]. Exploitation requires physical possession of the target disk and does not require authentication or user interaction. Successful exploitation results in disclosure of confidential data protected by the TPM-backed BitLocker deployment.
Critical Impact
An unauthenticated attacker with physical access to the system disk can recover serialized TPM 2.0 secrets and craft an environment to unseal the TPM, breaking disk encryption confidentiality.
Affected Products
- CPSD CryptoPro Secure Disk for Bitlocker versions before v7.7.4
Discovery Timeline
- 2026-08-12 - CVE-2025-59320 published to the National Vulnerability Database (NVD)
- 2026-08-12 - Last updated in NVD database
- Research presented at Black Hat USA in the session "The Cost of Obscurity" by Burch
Technical Details for CVE-2025-59320
Vulnerability Analysis
CPSD CryptoPro Secure Disk for Bitlocker integrates with the TPM 2.0 to seal secrets that gate access to BitLocker-protected volumes. In versions prior to v7.7.4, the product persists the serialized TPM 2.0 secret material into unused disk sectors outside of the normal filesystem. This storage location is not protected by access controls enforced by the operating system, because an attacker analyzing the raw disk bypasses the OS entirely. The design conflates unused sector storage with confidentiality, a form of security through obscurity. The Black Hat research titled The Cost of Obscurity documents the recovery technique. Because the secrets are serialized in a well-defined format, they can be extracted and replayed within a controlled TPM environment to unseal the sealed objects.
Root Cause
The root cause is insecure storage of sensitive information [CWE-922]. Serialized TPM 2.0 secrets are written to unused disk sectors without additional cryptographic protection tied to a factor the attacker cannot replay. Sealing to the TPM requires the persisted context, so exposing that context on disk undermines the sealing guarantee.
Attack Vector
The attack requires physical access to the system disk. An attacker removes or images the drive, parses the unused sectors for the serialized TPM 2.0 blob, and imports the recovered material into an environment they control. That environment is then used to unseal the TPM secret and recover the BitLocker protector. The attack does not require credentials or user interaction on the target system. See the Black Hat Whitepaper and the CPSD Blog Post for background.
No verified public exploit code is available. The vulnerability mechanism is described in the referenced Black Hat materials.
Detection Methods for CVE-2025-59320
Indicators of Compromise
- Evidence of the system disk being removed, imaged, or connected to an external forensic controller outside of maintenance windows.
- Chassis intrusion events or tamper-evident seal breaks on endpoints running CPSD CryptoPro Secure Disk for Bitlocker.
- Unexpected boot media, live USB usage, or firmware-level disk access recorded in platform logs.
Detection Strategies
- Inventory endpoints running CPSD CryptoPro Secure Disk for Bitlocker and identify installations at versions earlier than v7.7.4.
- Correlate physical security events (badge access, chassis intrusion, asset movement) with device offline periods to identify potential disk removal windows.
- Audit endpoints for unexpected TPM reset events or changes in TPM ownership state that could indicate replay of serialized secrets elsewhere.
Monitoring Recommendations
- Monitor Windows Event Log sources Microsoft-Windows-TPM-WMI and BitLocker-API for anomalous sealing, unsealing, or ownership operations.
- Track hardware inventory changes and lost or stolen device tickets against the affected endpoint population.
- Alert on offline duration exceeding maintenance baselines for encrypted endpoints protected by TPM sealing.
How to Mitigate CVE-2025-59320
Immediate Actions Required
- Upgrade CPSD CryptoPro Secure Disk for Bitlocker to v7.7.4 or later across all affected endpoints.
- Rotate TPM-sealed BitLocker protectors after upgrading so that any previously exposed serialized secrets no longer unlock current volumes.
- Treat any device that has been out of physical custody as potentially compromised and re-provision its disk encryption keys.
Patch Information
The vendor addresses the issue in CPSD CryptoPro Secure Disk for Bitlocker v7.7.4. Consult the CPSD Blog Post for release notes and upgrade guidance. After upgrading, re-seal TPM protectors so that pre-patch on-disk material cannot be reused.
Workarounds
- Enforce pre-boot authentication (PIN or startup key) in addition to TPM sealing so that recovered TPM material alone is insufficient to unlock the volume.
- Apply full-chassis tamper protection and enable BIOS or UEFI passwords to raise the cost of physical disk removal.
- Restrict physical access to endpoints storing sensitive data and enforce chain-of-custody controls for devices returned from field use, repair, or disposal.
# Enable BitLocker with TPM + PIN as a compensating control
manage-bde -protectors -add C: -TPMAndPIN
manage-bde -protectors -delete C: -type TPM
manage-bde -status C:
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
