Researcher Finds Nine CryptoPro Disk Flaws; Diebold Disputes ATM Risk
Summary
A researcher says nine CryptoPro Secure Disk flaws could expose encryption secrets and enable pre-boot code execution, potentially supporting ATM jackpotting. Diebold disputes the real-world risk to its ATMs and says two flaws may apply under certain conditions.
Key points
- Matt Burch of Atredis Partners reported nine vulnerabilities in CryptWare CryptoPro Secure Disk, a Windows full-disk encryption and pre-boot authentication product.
- The reported issues include failed decryption falling back to plaintext volume mounting and a superficial LUKS check that could be bypassed.
- Burch says encryption keys and configuration values stored on disk, combined with the plaintext issue, exposed secrets needed to decrypt the Windows environment.
- Burch also reported that the Secure Boot setup could allow an attacker to run an arbitrary Linux environment before Windows loads.
- Burch says the flaws could enable code execution on an ATM and cash theft using a standard jackpotting flow; this impact is not independently established in the article.
- Diebold says the findings are not directly applicable to its ATMs, while acknowledging some CryptoPro components in its Vynamic Security HDE and saying two flaws are theoretically applicable under certain conditions.
- Diebold says it addressed those two issues in a December 2025 update; Burch is scheduled to present the findings at Black Hat USA 2026.
Article Details
- Vulnerability Types
- Pre-boot decryption failures can cause volumes to be mounted in plaintext.
- A superficial LUKS encryption check can be bypassed to trigger plaintext mounting.
- Cryptographic key material and configuration values are stored on disk.
- The Secure Boot setup permits an attacker to run an arbitrary Linux environment before Windows loads.
- Severity
- Unknown
- Exploitation Status
- unknown
- Exploit Availability
- unknown
- Patch Status
- partial
MITRE ATT&CK
People
Matt BurchPrincipal security researcher for Atredis Partners who discovered the nine CryptoPro Secure Disk vulnerabilities and plans to present them at Black Hat USA 2026.Mike JacobsenDiebold Nixdorf senior director of corporate communications who disputed the findings' direct applicability and described their assessment of the ATM impact.
Malware
Vendors
CryptWareA researcher uncovered nine vulnerabilities in CryptWare CryptoPro Secure Disk, a pre-boot encryption tool used in enterprise environments and possibly within Diebold Nixdorf ATM security components.Diebold NixdorfA researcher uncovered nine vulnerabilities in CryptWare CryptoPro Secure Disk, a pre-boot encryption tool used in enterprise environments and possibly within Diebold Nixdorf ATM security components.
Products
CryptoPro Secure DiskA researcher uncovered nine vulnerabilities in CryptWare CryptoPro Secure Disk, a pre-boot encryption tool used in enterprise environments and possibly within Diebold Nixdorf ATM security components.Microsoft WindowsThe flaws affect a full-disk encryption and pre-boot authentication product used on Windows systems.Vynamic Security SuiteFor example, Diebold offers an all-in-one Vynamic Security Suite (VSS).