CVE Vulnerabilities

CVE-2019-10706

Insufficiently Protected Credentials

Published: Mar 10, 2020 | Modified: Mar 13, 2020
CVSS 3.x
6.3
MEDIUM
Source:
NVD
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H
CVSS 2.x
6.3 MEDIUM
AV:L/AC:M/Au:N/C:N/I:C/A:C
RedHat/V2
RedHat/V3
Ubuntu

Western Digital SanDisk SanDisk X300, X300s, X400, and X600 devices: The firmware update authentication method relies on a symmetric HMAC digest. The key used to validate this digest is present in a protected area of the device, and if extracted could be used to install arbitrary firmware to other devices.

Weakness

The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.

Affected Software

Name Vendor Start Version End Version
Sandisk_x600_sd9tb8w-128g_firmware Westerndigital * *

Potential Mitigations

References