CVE-2025-59321: CryptoPro Secure Disk Privilege Escalation

CVE-2025-59321 Overview

CVE-2025-59321 affects CPSD CryptoPro Secure Disk for Bitlocker versions prior to v7.7.4. The product ships with a default Trusted Platform Module (TPM) Platform Configuration Register (PCR) policy that does not account for the system boot state. As a result, an attacker can unseal the TPM through an unintended execution path or by transferring the sealed data to another hardware platform. This weakness undermines the pre-boot authentication guarantees that BitLocker with TPM sealing is expected to provide.

Critical Impact
An attacker with physical or local access can unseal the TPM and access BitLocker-protected data by boot-path manipulation or hardware relocation, bypassing full-disk encryption assurances.

Affected Products

CPSD CryptoPro Secure Disk for Bitlocker versions before v7.7.4
Endpoints relying on the default CPSD TPM PCR policy for BitLocker sealing
Systems provisioned without a hardened, boot-state-aware PCR binding

Discovery Timeline

2026-08-12 - CVE-2025-59321 published to the National Vulnerability Database
2026-08-12 - Last updated in the NVD database
Research disclosed in the Black Hat USA presentation "The Cost of Obscurity" (presentation, white paper)

Technical Details for CVE-2025-59321

Vulnerability Analysis

CryptoPro Secure Disk for Bitlocker (CPSD) uses the TPM to seal BitLocker key material. Sealing binds the key release to a set of PCR values that represent the measured boot state. The default policy shipped in versions before v7.7.4 selects PCRs that do not uniquely capture the intended boot chain. Because the sealing policy is under-specified, the TPM will release the key when measurements match values that can be reproduced outside the intended execution path.

This is a configuration and design flaw in how the sealing policy is constructed. It is not a cryptographic weakness in the TPM itself. Refer to the Black Hat white paper for the measurement analysis behind the finding.

Root Cause

The root cause is an insecure default TPM PCR policy that omits registers reflecting the full system boot state. Sealing decisions therefore ignore relevant portions of the measured launch. An attacker can satisfy the PCR policy through an alternate boot flow that produces equivalent measurements, or by replaying the sealed blob on different hardware that reaches the same PCR state.

Attack Vector

Exploitation requires access to the sealed data and, in typical scenarios, physical possession of the device or its storage. An attacker can boot the target through an alternate path that satisfies the weak PCR policy and triggers TPM unseal. Alternatively, the attacker can move the encrypted volume and associated sealed material to another platform, reproduce the required PCR state, and unseal the key. Once the key is released, the attacker can decrypt BitLocker-protected volumes offline.

No verified proof-of-concept code is published in the CVE record. See the Black Hat materials referenced above for the technical walkthrough of the boot-state reproduction technique.

Detection Methods for CVE-2025-59321

Indicators of Compromise

Unexpected boot configurations, alternate bootloaders, or changes to the UEFI boot order on CPSD-protected endpoints
TPM event log entries showing PCR extensions inconsistent with the approved boot chain
Devices reporting successful volume unlock without the expected pre-boot authentication interaction
Chain-of-custody gaps for lost, stolen, or serviced endpoints protected by CPSD

Detection Strategies

Audit the active TPM PCR policy on every endpoint and flag hosts still using the pre-v7.7.4 default policy
Compare current TPM PCR values and event logs against a known-good measured boot baseline
Correlate BIOS or UEFI firmware update events with subsequent unseal operations to identify measurement drift
Track hardware inventory changes (disk swaps, motherboard replacements) alongside CPSD unlock telemetry

Monitoring Recommendations

Forward Windows TPM and BitLocker event channels to a centralized logging platform for retention and search
Alert on boot configuration data (BCD) modifications and secure boot policy changes on protected endpoints
Monitor for offline access attempts and unusual removable media boots against CPSD-managed devices
Review CPSD administrative logs after every firmware, bootloader, or OS upgrade

How to Mitigate CVE-2025-59321

Immediate Actions Required

Upgrade CPSD CryptoPro Secure Disk for Bitlocker to v7.7.4 or later on all managed endpoints
Re-seal BitLocker key material under the updated, boot-state-aware PCR policy after upgrade
Inventory devices still running vulnerable versions and prioritize systems that leave controlled facilities
Rotate recovery keys for endpoints suspected of exposure or physical compromise

Patch Information

CPSD addresses CVE-2025-59321 in CryptoPro Secure Disk for Bitlocker v7.7.4. The fixed release updates the default TPM PCR policy so that sealed key release accounts for the system boot state. Consult the CPSD blog for release notes and the Black Hat white paper for background on the corrected measurement model.

Workarounds

Enforce a pre-boot PIN or passphrase in addition to TPM sealing to require user interaction before unseal
Manually configure a stricter PCR policy that includes boot-state-relevant registers such as PCR 0, 2, 4, and 7
Enable and enforce UEFI Secure Boot, and restrict boot devices in firmware to the primary internal disk
Apply firmware passwords and physical security controls to prevent alternate boot paths and hardware relocation

bash

# Example: enable BitLocker with TPM+PIN protector to require pre-boot authentication
manage-bde -protectors -add C: -TPMAndPIN
manage-bde -protectors -get C: