CVE-2023-22812 SanDisk PrivateAccess Deprecated TLS protocol versions supported
SanDisk PrivateAccess supports deprecated TLS versions, allowing man-in-the-middle attacks that compromise data confidentiality and integrity.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-22812?
CVE-2023-22812 is a high-severity vulnerability in SanDisk PrivateAccess, published on 24 Mar 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
SanDisk PrivateAccess versions prior to 6.4.9 support insecure TLS 1.0 and TLS 1.1 protocols which are susceptible to man-in-the-middle attacks thereby compromising confidentiality and integrity of data.
Weakness: CWE-327
Which versions are affected by CVE-2023-22812?
It affects 1 product.
Products include Westerndigital Sandisk Privateaccess.
How do I fix CVE-2023-22812?
No fix has been published for CVE-2023-22812 yet. Limit exposure of the affected software until one is available.
Is CVE-2023-22812 being exploited?
There is no known exploitation of CVE-2023-22812 in the wild and no public exploit code.
Sources
Also known as GHSA-9j9q-9x39-w892.