CVE-2025-59325 CPSD CVE debrief

Who should care

Defenders responsible for Bitlocker deployments using CPSD CryptoPro Secure Disk should assess exposure and prioritize verification and remediation efforts. This includes operators, platform administrators, vulnerability management teams, and security teams who need to verify and upgrade to CPSD CryptoPro Secure Disk for Bitlocker version 7.7.4 or later, assess exposure in Bitlocker deployments, and monitor for potential offline recovery attempts.

Why it matters

CVE-2025-59325 is a high-severity vulnerability in CPSD CryptoPro Secure Disk for Bitlocker that allows for offline recovery of secrets and cryptographic details. Defenders responsible for Bitlocker deployments should assess exposure, verify and upgrade to version 7.7.4 or later, and monitor for potential offline recovery attempts.

• Offline recovery of secrets and cryptographic details is possible
• Verification of Bitlocker deployments is necessary
• Upgrades to version 7.7.4 or later are required
• Monitoring for potential offline recovery attempts is recommended

Technical summary

CPSD CryptoPro Secure Disk for Bitlocker before version 7.7.4 fails to encrypt the initramfs contents, allowing for the offline recovery of secrets and cryptographic details. This vulnerability has a CVSS score of 7.5 and is classified as HIGH severity. The vulnerability affects Bitlocker deployments using CPSD CryptoPro Secure Disk, and defenders should prioritize verifying and upgrading to version 7.7.4 or later, assessing exposure in Bitlocker deployments, and monitoring for potential offline recovery attempts. The CVE record and NVD entry provide details on the vulnerability in CPSD CryptoPro Secure Disk for Bitlocker before version 7.7.4, which fails to encrypt initramfs contents.

Defensive priority

Defenders should prioritize verifying and upgrading to CPSD CryptoPro Secure Disk for Bitlocker version 7.7.4 or later, assessing exposure in Bitlocker deployments, and monitoring for potential offline recovery attempts.

Recommended defensive actions

• Verify and upgrade to CPSD CryptoPro Secure Disk for Bitlocker version 7.7.4 or later
• Assess exposure in Bitlocker deployments
• Monitor for potential offline recovery attempts
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability in CPSD CryptoPro Secure Disk for Bitlocker before version 7.7.4, which fails to encrypt initramfs contents. Vendor CPSD is explicitly mentioned in a source reference (CPSD blog) discussing the vulnerability.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.