CVE-2022-28383

Published: Jun 8, 2022Modified: Jun 17, 2026

6.8

Vector

CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 0.9 / Impact: 5.9

Source: NVD

Description

An issue was discovered in certain Verbatim drives through 2022-03-31. Due to insufficient firmware validation, an attacker can store malicious firmware code for the USB-to-SATA bridge controller on the USB drive (e.g., by leveraging physical access during the supply chain). This code is then executed. This affects Keypad Secure USB 3.2 Gen 1 Drive Part Number #49428, Store 'n' Go Secure Portable HDD GD25LK01-3637-C VER4.0, Executive Fingerprint Secure SSD GDMSFE01-INI3637-C VER1.1, and Fingerprint Secure Portable Hard Drive Part Number #53650.

Affected (4)

Products: Verbatim: Keypad Secure Usb 3.2 Gen 1 Firmware, Store 'n' Go Secure Portable Hdd Firmware, Executive Fingerprint Secure Ssd Firmware, Fingerprint Secure Portable Hard Drive Firmware

Verbatim

4 products

Keypad Secure Usb 3.2 Gen 1 Firmware

Store 'n' Go Secure Portable Hdd Firmware

Executive Fingerprint Secure Ssd Firmware

Fingerprint Secure Portable Hard Drive Firmware

Configuration A

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Verbatim Keypad Secure Usb 3.2 Gen 1 Firmware	Up to 2022-03-31

Running on/with	Platform Versions
Verbatim Keypad Secure Usb 3.2 Gen 1	All versions

Configuration B

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Verbatim Store 'n' Go Secure Portable Hdd Firmware	Up to 2022-03-31

Running on/with	Platform Versions
Verbatim Store 'n' Go Secure Portable Hdd	All versions

Configuration C

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Verbatim Executive Fingerprint Secure Ssd Firmware	Up to 2022-03-31

Running on/with	Platform Versions
Verbatim Executive Fingerprint Secure Ssd	All versions

Configuration D

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Verbatim Fingerprint Secure Portable Hard Drive Firmware	Up to 2022-03-31

Running on/with	Platform Versions
Verbatim Fingerprint Secure Portable Hard Drive	All versions

Related CWEs

CWE-20

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

References (28)

http://packetstormsecurity.com/files/167482/Verbatim-Keypad-Secure-USB-3.2-Gen-1-Drive-Missing-Control.html

Source: cve@mitre.org

ExploitMailing ListThird Party AdvisoryVDB Entry

http://packetstormsecurity.com/files/167508/Verbatim-Store-N-Go-Secure-Portable-HDD-GD25LK01-3637-C-VER4.0-Missing-Trust.html

Source: cve@mitre.org

ExploitMailing ListThird Party AdvisoryVDB Entry

http://packetstormsecurity.com/files/167535/Verbatim-Fingerprint-Secure-Portable-Hard-Drive-53650-Missing-Trust.html

Source: cve@mitre.org

ExploitMailing ListThird Party AdvisoryVDB Entry

http://packetstormsecurity.com/files/167539/Verbatim-Executive-Fingerprint-Secure-SSD-GDMSFE01-INI3637-C-VER1.1-Missing-Trust.html

Source: cve@mitre.org

ExploitMailing ListThird Party AdvisoryVDB Entry

http://seclists.org/fulldisclosure/2022/Jun/10

Source: cve@mitre.org

ExploitMailing ListThird Party Advisory

http://seclists.org/fulldisclosure/2022/Jun/12

Source: cve@mitre.org

ExploitMailing ListThird Party Advisory

http://seclists.org/fulldisclosure/2022/Jun/19

Source: cve@mitre.org

ExploitMailing ListThird Party Advisory

http://seclists.org/fulldisclosure/2022/Jun/25

Source: cve@mitre.org

ExploitMailing ListThird Party Advisory

http://seclists.org/fulldisclosure/2022/Oct/5

Source: cve@mitre.org

Mailing ListThird Party Advisory

https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2022-003.txt

Source: cve@mitre.org

ExploitThird Party Advisory

https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2022-007.txt

Source: cve@mitre.org

ExploitThird Party Advisory

https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2022-011.txt

Source: cve@mitre.org

ExploitThird Party Advisory

https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2022-016.txt

Source: cve@mitre.org

ExploitThird Party Advisory

https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2022-045.txt

Source: cve@mitre.org

ExploitThird Party Advisory

http://packetstormsecurity.com/files/167482/Verbatim-Keypad-Secure-USB-3.2-Gen-1-Drive-Missing-Control.html