PT-2021-21336 · Enc · Enc Datavault

Boi Sletterink + 1 · Published 2021-12-22 · Updated 2022-01-06 · CVE-2021-36750

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions ENC DataVault versions prior to 7.2 VaultAPI version v67

Description The issue is related to the mishandling of key derivation, which makes it easier for attackers to determine the passwords of all DataVault users. This affects DataVault users across USB drives sold under multiple brand names.

Recommendations For ENC DataVault versions prior to 7.2, update to version 7.2 or later to resolve the issue. For VaultAPI version v67, consider disabling the use of this version until a patched version is available.

Fix

Improper Restriction of Excessive Authentication Attempts

Weakness Enumeration

CWE-307

Related Identifiers

CVE-2021-36750

Affected Products

Enc Datavault

References · 9

• https://osv.dev/vulnerability/CVE-2021-36750 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-36750 · Security Note
• https://encsecurity.zendesk.com/hc/en-us/articles/4413283717265-Update-for-ENC-Software · Vendor Advisory
• https://pretalx.c3voc.de/rc3-2021-r3s/talk/QMYGR3 · Note
• https://t.me/cibsecurity/34494 · Telegram Post
• https://westerndigital.com/en-ap/support/product-security/wdc-21014-sandisk-secureaccess-software-update · Note
• https://t.me/cvenotify/25029 · Telegram Post
• https://t.me/cvenotify/24782 · Telegram Post
• https://encsecurity.com/solutions.php · Note