PT-2021-17886 · Western Digital · Western Digital G-Technology Armorlock Nvme Ssd

Published 2021-03-18 · Updated 2021-08-27 · CVE-2021-28653

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Western Digital G-Technology ArmorLock NVMe SSD apps versions prior to 1.4.1

Description: The issue concerns the insecure storage of keys in the iOS and macOS apps for the Western Digital G-Technology ArmorLock NVMe SSD. Specifically, these apps choose a non-preferred storage mechanism if the device has Secure Enclave support but lacks biometric authentication hardware.

Recommendations: For versions prior to 1.4.1, update to version 1.4.1 or later to resolve the issue. As a temporary workaround, consider restricting access to sensitive data stored on the Western Digital G-Technology ArmorLock NVMe SSD until the update is applied.

Fix

Insecure Storage of Sensitive Information

Weakness Enumeration

CWE-922

Related Identifiers

CVE-2021-28653

Affected Products

Western Digital G-Technology Armorlock Nvme Ssd

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2021-28653 · Security Note
• https://westerndigital.com/support/productsecurity/wdc-21003-armorLock-insecure-key-storage-vulnerability · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-28653 · Vendor Advisory
• https://t.me/cvenotify/11554 · Telegram Post
• https://t.me/cvenotify/11971 · Telegram Post
• https://t.me/cvenotify/20256 · Telegram Post
• https://t.me/cibsecurity/25163 · Telegram Post