CVE-2022-28383 Supply chain in n/a
Attackers with physical access can inject malicious firmware into Verbatim secure drives due to insufficient validation, leading to arbitrary code execution.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-28383?
CVE-2022-28383 is a medium-severity vulnerability in n/a, published on 8 Jun 2022. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
An issue was discovered in certain Verbatim drives through 2022-03-31. Due to insufficient firmware validation, an attacker can store malicious firmware code for the USB-to-SATA bridge controller on the USB drive (e.g., by leveraging physical access during the supply chain). This code is then executed. This affects Keypad Secure USB 3.2 Gen 1 Drive Part Number #49428, Store 'n' Go Secure Portable HDD GD25LK01-3637-C VER4.0, Executive Fingerprint Secure SSD GDMSFE01-INI3637-C VER1.1, and Fingerprint Secure Portable Hard Drive Part Number #53650.
Weakness: CWE-20
Which versions are affected by CVE-2022-28383?
It affects 4 products.
Products include Verbatim Executive Fingerprint Secure Ssd Firmware, Verbatim Fingerprint Secure Portable Hard Drive Firmware, Verbatim Keypad Secure Usb 3.2 Gen 1 Firmware, Verbatim Store \'N\' Go Secure Portable Hdd Firmware.
How do I fix CVE-2022-28383?
No fix has been published for CVE-2022-28383 yet. Limit exposure of the affected software until one is available.
Is CVE-2022-28383 being exploited?
There is no known exploitation of CVE-2022-28383 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-fhv3-3747-jg9w.