High severity · published Dec 22, 2021
CVE-2021-36750
ENC DataVault before 7.2 and VaultAPI v67 mishandle key derivation, making it easier for attackers to determine the passwords of all DataVault users (across USB drives sold under…
8.1
CVSS
13.5%
EPSS
No
On KEV
Description
ENC DataVault before 7.2 and VaultAPI v67 mishandle key derivation, making it easier for attackers to determine the passwords of all DataVault users (across USB drives sold under multiple brand names).
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)13.5% · higher than 96% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
ED
Enc Datavault · Zendesk
before 7.2 · source: NVD
EV
Enc Vaultapi · Zendesk
before 67.0 · source: NVD
SE
Secureaccess · Sandisk
3.02 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-36750
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-36750
Vendor Advisory
https://encsecurity.zendesk.com/hc/en-us/articles/4413283717265-Update-for-ENC-Software
Third Party Advisory
https://pretalx.c3voc.de/rc3-2021-r3s/talk/QMYGR3/
Product
https://www.encsecurity.com/solutions.php
Third Party Advisory
https://www.westerndigital.com/en-ap/support/product-security/wdc-21014-sandisk-secureaccess-software-update
More from Secureaccess
4.3
CVE-2017-16560
SanDisk Secure Access 3.01 vault decrypts and copies encrypted files to a temporary folder, where they can remain indefinitely in certain situations, such as if the file is being…