CVE-2021-36750

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2021-36750
ENC DataVault before 7.2 and VaultAPI v67 mishandle key derivation, making it easier for attackers to determine the passwords of all DataVault users (across USB drives sold under multiple brand names).

8.1 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

5.5 /10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:L/Au:S/C:P/I:P/A:N

Exploitability : 8.0 / Impact : 4.9

Access Vector NETWORK

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact NONE

References
Link Resource
https://encsecurity.zendesk.com/hc/en-us/articles/4413283717265-Update-for-ENC-Software Vendor Advisory
https://pretalx.c3voc.de/rc3-2021-r3s/talk/QMYGR3/ Third Party Advisory
https://www.encsecurity.com/solutions.php Product
https://www.westerndigital.com/en-ap/support/product-security/wdc-21014-sandisk-secureaccess-software-update Third Party Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:zendesk:enc_datavault:*:*:*:*:*:*:*:*
cpe:2.3:a:zendesk:enc_vaultapi:*:*:*:*:*:*:*:*

Configuration 2 (hide)

cpe:2.3:a:sandisk:secureaccess:3.02:*:*:*:*:*:*:*
History

06 Jan 2022, 14:13

Type Values Removed Values Added
CPE cpe:2.3:a:zendesk:enc_vaultapi:*:*:*:*:*:*:*:*
cpe:2.3:a:zendesk:enc_datavault:*:*:*:*:*:*:*:*
cpe:2.3:a:sandisk:secureaccess:3.02:*:*:*:*:*:*:*
First Time Sandisk secureaccess
Zendesk
Sandisk
Zendesk enc Datavault
Zendesk enc Vaultapi
CWE CWE-307
CVSS v2 : unknown
v3 : unknown 		v2 : 5.5
v3 : 8.1
References (MISC) https://www.westerndigital.com/en-ap/support/product-security/wdc-21014-sandisk-secureaccess-software-update - (MISC) https://www.westerndigital.com/en-ap/support/product-security/wdc-21014-sandisk-secureaccess-software-update - Third Party Advisory
References (MISC) https://pretalx.c3voc.de/rc3-2021-r3s/talk/QMYGR3/ - (MISC) https://pretalx.c3voc.de/rc3-2021-r3s/talk/QMYGR3/ - Third Party Advisory
References (MISC) https://www.encsecurity.com/solutions.php - (MISC) https://www.encsecurity.com/solutions.php - Product
References (MISC) https://encsecurity.zendesk.com/hc/en-us/articles/4413283717265-Update-for-ENC-Software - (MISC) https://encsecurity.zendesk.com/hc/en-us/articles/4413283717265-Update-for-ENC-Software - Vendor Advisory

02 Jan 2022, 16:15

Type Values Removed Values Added
Summary ENC DataVault 7.1.1W and VaultAPI v67, which is currently being used in various other applications, mishandles key derivation, making it easier for attackers to determine the passwords of all DataVault users (across USB drives sold under multiple brand names). ENC DataVault before 7.2 and VaultAPI v67 mishandle key derivation, making it easier for attackers to determine the passwords of all DataVault users (across USB drives sold under multiple brand names).
References
  • (MISC) https://pretalx.c3voc.de/rc3-2021-r3s/talk/QMYGR3/ -

28 Dec 2021, 17:15

Type Values Removed Values Added
References
  • (MISC) https://www.westerndigital.com/en-ap/support/product-security/wdc-21014-sandisk-secureaccess-software-update -

22 Dec 2021, 14:15

Type Values Removed Values Added
New CVE
Information

Published : 2021-12-22 14:15

Updated : 2023-12-10 14:09

NVD link : CVE-2021-36750

Mitre link : CVE-2021-36750

CVE.ORG link : CVE-2021-36750

JSON object : View

Products Affected

zendesk

  • enc_vaultapi
  • enc_datavault

sandisk

  • secureaccess
CWE
CWE-307

Improper Restriction of Excessive Authentication Attempts