PT-2019-13351 · Sandisk+1 · Sandisk Ssd Dashboard+1

Published 2019-09-30 · Updated 2020-08-24 · CVE-2019-13466

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Western Digital SSD Dashboard versions prior to 2.5.1.0 SanDisk SSD Dashboard versions prior to 2.5.1.0

Description The issue is related to Incorrect Access Control. Specifically, the generate reports archive is protected with a hard-coded password, which poses a security risk. An update is available that addresses the protection of archive encryption.

Recommendations For Western Digital SSD Dashboard versions prior to 2.5.1.0, update to version 2.5.1.0 or later to address the issue. For SanDisk SSD Dashboard versions prior to 2.5.1.0, update to version 2.5.1.0 or later to address the issue.

Fix

Using Hardcoded Credentials

Weakness Enumeration

CWE-798

Related Identifiers

CVE-2019-13466

Affected Products

Sandisk Ssd Dashboard

Western Digital Ssd Dashboard

References · 4

• https://westerndigital.com/support/productsecurity/wdc-19009-sandisk-and-western-digital-ssd-dashboard-vulnerabilities · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-13466 · Vendor Advisory
• https://support.wdc.com/downloads.aspx?g=907&lang=en · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-13466 · Security Note