PT-2022-12687 · Lexar · Lexar F35
Donghyeun Kim
+2
·
Published
2022-03-21
·
Updated
2022-03-29
·
CVE-2021-46390
CVSS v2.0
7.2
High
| Vector | AV:L/AC:L/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
Lexar F35 version 1.0.34
Description
An access control issue in the authentication module allows attackers to access sensitive data and cause a Denial of Service (DoS). Attackers can bypass user authentication without having any information related to the password of the registered user. The secure USB flash drive transmits the password entered by the user to the authentication module, which compares the input password with the registered password stored in the module. An attacker can bypass password authentication by analyzing the functions that return the password verification or comparison results and manipulate the authentication result values. This allows attackers to be authenticated as a legitimate user, even with an incorrect password, and exploit functions of the secure USB flash drive.
Recommendations
For Lexar F35 version 1.0.34, as a temporary workaround, consider restricting access to the authentication module until a patch is available. Avoid using the authentication functions that return the password verification or comparison results until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Exploit
Improper Authentication
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Lexar F35