CVE-2021-36750 Weak cryptography in n/a
Weak key derivation in ENC DataVault allows attackers to determine user passwords, compromising data on USB drives.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-36750?
CVE-2021-36750 is a high-severity vulnerability in n/a, published on 22 Dec 2021. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
ENC DataVault before 7.2 and VaultAPI v67 mishandle key derivation, making it easier for attackers to determine the passwords of all DataVault users (across USB drives sold under multiple brand names).
Weakness: CWE-307
Which versions are affected by CVE-2021-36750?
It affects 3 products.
Products include Sandisk Secureaccess, Zendesk Enc Datavault, Zendesk Enc Vaultapi.
How do I fix CVE-2021-36750?
No fix has been published for CVE-2021-36750 yet. Limit exposure of the affected software until one is available.
Is CVE-2021-36750 being exploited?
There is no known exploitation of CVE-2021-36750 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in n/a
Sources
Also known as GHSA-pj9c-cg8c-hvp4.