CVE-2019-10706
Medium
Description
Western Digital SanDisk SanDisk X300, X300s, X400, and X600 devices: The firmware update authentication method relies on a symmetric HMAC digest. The key used to validate this digest is present in a protected area of the device, and if extracted could be used to install arbitrary firmware to other devices.
SeverityMedium
CVSS6.3
Exploit probability—
ProductWesterndigital Sandisk X600 Sd9tb8w-128g Firmware
PublishedMar 10, 2020
First seenMar 10, 2020
How to fix
Update
- westerndigital sandisk_x600_sd9tb8w-128g_firmwarex6112100 or later
- westerndigital sandisk_x600_sd9tb8w-256g_firmwarex6112100 or later
- westerndigital sandisk_x600_sd9tb8w-512g_firmwarex6112100 or later
- westerndigital sandisk_x600_sd9tb8w-1t00_firmwarex6112100 or later
- westerndigital sandisk_x600_sd9tb8w-2t00_firmwarex6112100 or later
- westerndigital sandisk_x600_sd9tn8w-128g_firmwarex6112100 or later
- westerndigital sandisk_x600_sd9tn8w-256g_firmwarex6112100 or later
- westerndigital sandisk_x600_sd9tn8w-512g_firmwarex6112100 or later
- westerndigital sandisk_x600_sd9tn8w-1t00_firmwarex6112100 or later
- westerndigital sandisk_x600_sd9tn8w-2t00_firmwarex6112100 or later
- westerndigital sandisk_x600_sd9sb8w-128g_firmwarex6112100 or later
- westerndigital sandisk_x600_sd9sb8w-256g_firmwarex6112100 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| westerndigital sandisk_x600_sd9tb8w-128g_firmware | v < x6112100 | x6112100 |
| westerndigital sandisk_x600_sd9tb8w-256g_firmware | v < x6112100 | x6112100 |
| westerndigital sandisk_x600_sd9tb8w-512g_firmware | v < x6112100 | x6112100 |
| westerndigital sandisk_x600_sd9tb8w-1t00_firmware | v < x6112100 | x6112100 |
| westerndigital sandisk_x600_sd9tb8w-2t00_firmware | v < x6112100 | x6112100 |
| westerndigital sandisk_x600_sd9tn8w-128g_firmware | v < x6112100 | x6112100 |
| westerndigital sandisk_x600_sd9tn8w-256g_firmware | v < x6112100 | x6112100 |
| westerndigital sandisk_x600_sd9tn8w-512g_firmware | v < x6112100 | x6112100 |
| westerndigital sandisk_x600_sd9tn8w-1t00_firmware | v < x6112100 | x6112100 |
| westerndigital sandisk_x600_sd9tn8w-2t00_firmware | v < x6112100 | x6112100 |
| westerndigital sandisk_x600_sd9sb8w-128g_firmware | v < x6112100 | x6112100 |
| westerndigital sandisk_x600_sd9sb8w-256g_firmware | v < x6112100 | x6112100 |
| westerndigital sandisk_x600_sd9sb8w-512g_firmware | v < x6112100 | x6112100 |
| westerndigital sandisk_x600_sd9sb8w-1t00_firmware | v < x6112100 | x6112100 |
| westerndigital sandisk_x600_sd9sb8w-2t00_firmware | v < x6112100 | x6112100 |
| westerndigital sandisk_x600_sd9sn8w-128g_firmware | v < x6112100 | x6112100 |
| westerndigital sandisk_x600_sd9sn8w-256g_firmware | v < x6112100 | x6112100 |
| westerndigital sandisk_x600_sd9sn8w-512g_firmware | v < x6112100 | x6112100 |
| westerndigital sandisk_x600_sd9sn8w-1t00_firmware | v < x6112100 | x6112100 |
| westerndigital sandisk_x600_sd9sn8w-2t00_firmware | v < x6112100 | x6112100 |
| westerndigital sandisk_x300s_sd7sb3q-064g_firmware | No range specified | — |
| westerndigital sandisk_x300s_sd7sn3q-064g_firmware | No range specified | — |
| westerndigital sandisk_x300s_sd7ub2q-010t_firmware | No range specified | — |
| westerndigital sandisk_x300s_sd7ub2q-512g_firmware | No range specified | — |
| westerndigital sandisk_x300s_sd7ub3q-128g_firmware | No range specified | — |
| westerndigital sandisk_x300s_sd7ub3q-256g_firmware | No range specified | — |
| westerndigital sandisk_x300s_sd7un3q-128g_firmware | No range specified | — |
| westerndigital sandisk_x300s_sd7un3q-256g_firmware | No range specified | — |
| westerndigital sandisk_x300s_sd7un3q-512g_firmware | No range specified | — |
| westerndigital sandisk_x400_sd8sb8u-128g_firmware | No range specified | — |
| westerndigital sandisk_x400_sd8sb8u-128g-1122_firmware | No range specified | — |
| westerndigital sandisk_x400_sd8sb8u-1t00_firmware | No range specified | — |
| westerndigital sandisk_x400_sd8sb8u-1t00-1122_firmware | No range specified | — |
| westerndigital sandisk_x400_sd8sb8u-256g_firmware | No range specified | — |
| westerndigital sandisk_x400_sd8sb8u-256g-1122_firmware | No range specified | — |
| westerndigital sandisk_x400_sd8sb8u-512g_firmware | No range specified | — |
| westerndigital sandisk_x400_sd8sb8u-512g-1122_firmware | No range specified | — |
| westerndigital sandisk_x400_sd8sn8u-128g_firmware | No range specified | — |
| westerndigital sandisk_x400_sd8sn8u-128g-1122_firmware | No range specified | — |
| westerndigital sandisk_x400_sd8sn8u-1t00_firmware | No range specified | — |
| westerndigital sandisk_x400_sd8sn8u-1t00-1122_firmware | No range specified | — |
| westerndigital sandisk_x400_sd8sn8u-256g_firmware | No range specified | — |
| westerndigital sandisk_x400_sd8sn8u-256g-1122_firmware | No range specified | — |
| westerndigital sandisk_x400_sd8sn8u-512g_firmware | No range specified | — |
| westerndigital sandisk_x400_sd8sn8u-512g-1122_firmware | No range specified | — |
| westerndigital sandisk_x400_sd8tb8u-128g-1122_firmware | No range specified | — |
| westerndigital sandisk_x400_sd8tb8u-1t00-1122_firmware | No range specified | — |
| westerndigital sandisk_x400_sd8tb8u-256g-1122_firmware | No range specified | — |
| westerndigital sandisk_x400_sd8tb8u-512g-1122_firmware | No range specified | — |
| westerndigital sandisk_x300_sd7sb6s-128g_firmware | No range specified | — |
| westerndigital sandisk_x300_sd7sb6s-256g_firmware | No range specified | — |
| westerndigital sandisk_x300_sd7sb7s-010t_firmware | No range specified | — |
| westerndigital sandisk_x300_sd7sb7s-512g_firmware | No range specified | — |
| westerndigital sandisk_x300_sd7sf6s-128g_firmware | No range specified | — |
| westerndigital sandisk_x300_sd7sf6s-256g_firmware | No range specified | — |
| westerndigital sandisk_x300_sd7sf6s-512g_firmware | No range specified | — |
| westerndigital sandisk_x300_sd7sn6s-128g_firmware | No range specified | — |
| westerndigital sandisk_x300_sd7sn6s-256g_firmware | No range specified | — |
| westerndigital sandisk_x300_sd7sn6s-512g_firmware | No range specified | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.