Security readout for executives and security teams
Plain-English summary
CryptoPro Secure Disk for BitLocker versions before 7.7.4 may leave initramfs contents unencrypted. Someone able to examine the system offline could recover secrets or cryptographic details expected to be protected by disk encryption. This creates a serious confidentiality risk, especially for lost, stolen, or physically accessible devices.
Executive priority
Address promptly on laptops, field systems, and other devices vulnerable to loss or physical access. Begin with version discovery, then follow vendor guidance for upgrading. Escalate incident review and secret rotation where affected devices were lost, stolen, or accessed outside organizational control.
Technical view
CVE-2025-59325 is classified as CWE-311: missing encryption of sensitive data. The supplied description states that affected releases fail to encrypt initramfs contents, enabling offline secret recovery. The published CVSS 3.1 score is 7.5 for high confidentiality impact, although its network attack vector appears inconsistent with the described offline scenario.
Likely exposure
Exposure is likely limited to systems using CPSD CryptoPro Secure Disk for BitLocker earlier than version 7.7.4. The bundle provides no CPEs, deployment details, or authoritative affected-version table, so organizations must verify product presence and versions locally.
Exploitation context
The bundle describes offline recovery, implying access to stored system data or the device. It provides no evidence of remote exploitation. The CVE is not listed as KEV, and none of the supplied information states that active exploitation has occurred.
Researcher notes
The source metadata is incomplete: vendor, product, versions, and CPE fields are recorded as unavailable despite the title naming the product and version boundary. The CVSS AV:N vector conflicts with the description of offline recovery. Validate scope and attack prerequisites against the CVE record, CPSD guidance, and referenced Black Hat research.
Mitigation direction
- Inventory systems running CPSD CryptoPro Secure Disk for BitLocker and record installed versions.
- Prioritize systems earlier than 7.7.4, particularly portable or physically exposed devices.
- Confirm upgrade or remediation instructions through current CPSD vendor guidance.
- Upgrade to version 7.7.4 or later where vendor guidance confirms applicability.
- Treat potentially exposed initramfs secrets as compromised and assess whether rotation is necessary.
Validation and detection
- Confirm the installed CPSD version using approved asset or software inventory records.
- Verify upgraded systems report version 7.7.4 or later.
- In an authorized lab, confirm initramfs contents are encrypted and disclose no recoverable secrets.
- Review lost-device and physical-access incidents involving affected systems.
- Confirm sensitive credentials or cryptographic material identified during assessment were rotated.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-311: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2025-59325 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N3.93.6CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
7.5HighVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://www.cpsd.at/blog/CVE reference, mitre
- https://i.blackhat.com/BH-USA-26/Presentations/US-26-Burch-The-Cost-of-Obscurity-Wednesday.pdfCVE reference, mitre
- https://i.blackhat.com/BH-USA-26/Presentations/US-26-Burch-The-Cost-of-Obscurity-wp.pdfCVE reference, mitre
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Missing Encryption of Sensitive Data
Missing Encryption of Sensitive Data represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.