CVE-2022-28387

Опубликовано: 08 июн. 2022

Источник: nvd

CVSS3: 4.6

CVSS2: 2.1

EPSS Низкий

Описание

An issue was discovered in certain Verbatim drives through 2022-03-31. Due to an insecure design, they can be unlocked by an attacker who can then gain unauthorized access to the stored data. The attacker can simply use an undocumented IOCTL command that retrieves the correct password. This affects Executive Fingerprint Secure SSD GDMSFE01-INI3637-C VER1.1 and Fingerprint Secure Portable Hard Drive Part Number #53650.

Ссылки

http://packetstormsecurity.com/files/167527/Verbatim-Executive-Fingerprint-Secure-SSD-GDMSFE01-INI3637-C-VER1.1-Risky-Crypto.html
Exploit
Mailing List
Third Party Advisory
http://packetstormsecurity.com/files/167531/Verbatim-Fingerprint-Secure-Portable-Hard-Drive-53650-Risky-Crypto.html
Exploit
Mailing List
Third Party Advisory
http://seclists.org/fulldisclosure/2022/Jun/13
Exploit
Mailing List
Third Party Advisory
http://seclists.org/fulldisclosure/2022/Jun/21
Exploit
Mailing List
Third Party Advisory
https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2022-009.txt
Exploit
Third Party Advisory
https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2022-014.txt
Exploit
Third Party Advisory
http://packetstormsecurity.com/files/167527/Verbatim-Executive-Fingerprint-Secure-SSD-GDMSFE01-INI3637-C-VER1.1-Risky-Crypto.html
Exploit
Mailing List
Third Party Advisory
http://packetstormsecurity.com/files/167531/Verbatim-Fingerprint-Secure-Portable-Hard-Drive-53650-Risky-Crypto.html
Exploit
Mailing List
Third Party Advisory
http://seclists.org/fulldisclosure/2022/Jun/13
Exploit
Mailing List
Third Party Advisory
http://seclists.org/fulldisclosure/2022/Jun/21
Exploit
Mailing List
Third Party Advisory
https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2022-009.txt
Exploit
Third Party Advisory
https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2022-014.txt
Exploit
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

Одновременно

cpe:2.3:o:verbatim:executive_fingerprint_secure_ssd_firmware:*:*:*:*:*:*:*:*

Версия до 2022-03-31 (включая)

cpe:2.3:h:verbatim:executive_fingerprint_secure_ssd:-:*:*:*:*:*:*:*

Конфигурация 2

Одновременно

cpe:2.3:o:verbatim:fingerprint_secure_portable_hard_drive_firmware:*:*:*:*:*:*:*:*

Версия до 2022-03-31 (включая)

cpe:2.3:h:verbatim:fingerprint_secure_portable_hard_drive:-:*:*:*:*:*:*:*

EPSS

Процентиль: 41%

0.00195

Низкий

4.6 Medium

CVSS3

2.1 Low

CVSS2

Дефекты

NVD-CWE-noinfo

Связанные уязвимости

GHSA-xmmw-wq4f-3pw5