CVE-2019-10706 Hardcoded credentials in n/a
Attackers can extract the symmetric HMAC key from device firmware to install arbitrary firmware on other devices, enabling code execution and privilege escalation.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2019-10706?
CVE-2019-10706 is a medium-severity vulnerability in n/a, published on 10 Mar 2020. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Western Digital SanDisk SanDisk X300, X300s, X400, and X600 devices: The firmware update authentication method relies on a symmetric HMAC digest. The key used to validate this digest is present in a protected area of the device, and if extracted could be used to install arbitrary firmware to other devices.
Weakness: CWE-522
Which versions are affected by CVE-2019-10706?
It affects 59 products.
Products include Westerndigital Sandisk X300 Sd7sb6s-128g Firmware, Westerndigital Sandisk X300 Sd7sb6s-256g Firmware, Westerndigital Sandisk X300 Sd7sb7s-010t Firmware, Westerndigital Sandisk X300 Sd7sb7s-512g Firmware, Westerndigital Sandisk X300 Sd7sf6s-128g Firmware, Westerndigital Sandisk X300 Sd7sf6s-256g Firmware and 53 more.
How do I fix CVE-2019-10706?
No fix has been published for CVE-2019-10706 yet. Limit exposure of the affected software until one is available.
Is CVE-2019-10706 being exploited?
There is no known exploitation of CVE-2019-10706 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-24jw-qhh7-33q6.