CVE-2022-28387 describes an insecure design flaw in specific Verbatim Executive Fingerprint Secure SSD and Fingerprint Secure Portable Hard Drive models. An attacker with physical access to the device can bypass security by using an undocumented IOCTL command to retrieve the correct password, gaining unauthorized access to stored data. This vulnerability has a CVSS score of 4.6 (Medium) due to its physical attack vector and high confidentiality impact, despite low attack complexity. While there is no known active exploitation or public exploit code, the vulnerability has garnered some community discussion, including a Reddit post detailing the hacking of a similar device.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
<= 2022-03-31CPE matchmatch criteria | cpe:2.3:o:verbatim:executive_fingerprint_secure_ssd_firmware:*:*:*:*:*:*:*:* | ||
<= 2022-03-31CPE matchmatch criteria | cpe:2.3:o:verbatim:fingerprint_secure_portable_hard_drive_firmware:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.2 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.