CVE-2022-28383
Description
An issue was discovered in certain Verbatim drives through 2022-03-31. Due to insufficient firmware validation, an attacker can store malicious firmware code for the USB-to-SATA bridge controller on the USB drive (e.g., by leveraging physical access during the supply chain). This code is then executed. This affects Keypad Secure USB 3.2 Gen 1 Drive Part Number #49428, Store 'n' Go Secure Portable HDD GD25LK01-3637-C VER4.0, Executive Fingerprint Secure SSD GDMSFE01-INI3637-C VER1.1, and Fingerprint Secure Portable Hard Drive Part Number #53650.
How to fix
Sources list no fixed version or patch link for this vulnerability.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| verbatim keypad_secure_usb_3.2_gen_1_firmware | v ≤ 2022-03-31 | — |
| verbatim store_\'n\'_go_secure_portable_hdd_firmware | v ≤ 2022-03-31 | — |
| verbatim executive_fingerprint_secure_ssd_firmware | v ≤ 2022-03-31 | — |
| verbatim fingerprint_secure_portable_hard_drive_firmware | v ≤ 2022-03-31 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.