PT-2023-18710 · Sandisk · Sandisk Privateaccess

Published 2023-03-24 · Updated 2023-11-04 · CVE-2023-22812

Positive Technologies (AI Summary)

CVSS v3.1

7.4

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions SanDisk PrivateAccess versions prior to 6.4.9

Description The issue concerns the support of insecure TLS 1.0 and TLS 1.1 protocols, making the system susceptible to man-in-the-middle attacks. This compromises the confidentiality and integrity of data.

Recommendations For SanDisk PrivateAccess versions prior to 6.4.9, update to version 6.4.9 or later to resolve the issue. As a temporary workaround, consider disabling the use of TLS 1.0 and TLS 1.1 protocols until a patch is available. Restrict access to sensitive data to minimize the risk of exploitation.

Fix

Use of a Broken Cryptographic Algorithm

Weakness Enumeration

CWE-327

Related Identifiers

CVE-2023-22812

Affected Products

Sandisk Privateaccess

References · 5

• https://osv.dev/vulnerability/CVE-2023-22812 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-22812 · Security Note
• https://westerndigital.com/support/product-security/wdc-23005-sandisk-privateaccess-software-update · Vendor Advisory
• https://t.me/cvenotify/47079 · Telegram Post
• https://t.me/cvenotify/60510 · Telegram Post