CVE-2022-28382 – This CVE describes a cryptographic vulnerabilit... (How to Fix)

Q: What is the severity of CVE-2022-28382?

CVE-2022-28382 has a CVSS score of 7.5 (HIGH). This CVE describes a cryptographic vulnerability in certain Verbatim encrypted storage drives where AES-256 encryption uses insecure ECB mode instead of a secure mode like CBC or GCM. This allows attackers to potentially extract information from encrypted data by analyzing patterns, compromising confidentiality even when data is encrypted. Affected users include anyone using the specific Verbatim encrypted drives listed below.

📋 TL;DR

This CVE describes a cryptographic vulnerability in certain Verbatim encrypted storage drives where AES-256 encryption uses insecure ECB mode instead of a secure mode like CBC or GCM. This allows attackers to potentially extract information from encrypted data by analyzing patterns, compromising confidentiality even when data is encrypted. Affected users include anyone using the specific Verbatim encrypted drives listed below.

💻 Affected Systems

Products:

Verbatim Keypad Secure USB 3.2 Gen 1 Drive Part Number #49428
Verbatim Store 'n' Go Secure Portable HDD GD25LK01-3637-C VER4.0
Verbatim Executive Fingerprint Secure SSD GDMSFE01-INI3637-C VER1.1
Verbatim Fingerprint Secure Portable Hard Drive Part Number #53650

Versions: All versions through March 31, 2022

Operating Systems: All operating systems that can mount the drives

Default Config Vulnerable: ⚠️ Yes

Notes: Vulnerability is in the firmware of the USB-to-SATA bridge controller INIC-3637EN. All data encrypted on these drives using their built-in encryption is affected.

📦 What is this software?

⚠️ Risk & Real-World Impact

🔴

Worst Case

Complete compromise of encrypted data confidentiality, allowing attackers to reconstruct sensitive files like images, documents, or structured data from encrypted drives without breaking the encryption key.

🟠

Likely Case

Partial information leakage where attackers can identify file types, detect patterns, or extract metadata from encrypted data, potentially revealing sensitive information about stored content.

🟢

If Mitigated

Limited impact if drives contain only random, unstructured data without repeating patterns, though ECB mode remains cryptographically insecure regardless of data type.

🌐 Internet-Facing: LOW - These are physical storage devices, not network services. The vulnerability requires physical or local access to the encrypted drive.

🏢 Internal Only: MEDIUM - The risk exists when drives are used within organizations, especially if they contain sensitive data with repeating patterns and could be accessed by malicious insiders or lost/stolen.

🎯 Exploit Status

Public PoC: ⚠️ Yes

Weaponized: LIKELY

Unauthenticated Exploit: ⚠️ Yes

Complexity: LOW

Exploitation requires access to encrypted data from the drive. Public proof-of-concept demonstrates pattern analysis on encrypted data. No authentication bypass needed as the vulnerability is in the encryption implementation itself.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Not available

Vendor Advisory: No official vendor advisory found in provided references

Restart Required: No

Instructions:

No firmware patch is available. The only official fix would require hardware replacement with updated drives using secure encryption modes.

🔧 Temporary Workarounds

Use software-based encryption

all

Disable the drive's hardware encryption and use operating system or third-party software encryption (like BitLocker, VeraCrypt, or LUKS) with secure modes like CBC, XTS, or GCM.

Encrypt data before storage

all

Encrypt sensitive files individually using strong encryption tools before saving them to the drive, effectively double-encrypting the data.

🧯 If You Can't Patch

Stop using affected drives for sensitive data and migrate to securely encrypted alternatives
Implement strict physical security controls and inventory tracking for affected drives

🔍 How to Verify

Check if Vulnerable:

Check drive model and part number against affected products list. For technical verification, analyze encrypted data patterns - ECB mode will show repeating 16-byte patterns in ciphertext when plaintext has repeating patterns.

Check Version:

No standard command - check physical drive labeling for model numbers and part numbers

Verify Fix Applied:

Verify that either: 1) Drive has been replaced with non-vulnerable model, or 2) Software encryption is properly implemented and hardware encryption is disabled.

📡 Detection & Monitoring

Log Indicators:

No specific log indicators as this is a hardware/firmware vulnerability

Network Indicators:

Not applicable - this is not a network vulnerability

SIEM Query:

Not applicable for this hardware-based vulnerability

📊 Metadata

CVE ID: CVE-2022-28382

CVSS v3 Score: 7.5 (HIGH)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CWE: CWE-327

Published: June 8, 2022

Last Updated: November 21, 2024

🔗 References

http://packetstormsecurity.com/files/167491/Verbatim-Keypad-Secure-USB-3.2-Gen-1-Drive-ECB-Issue.html Exploit,Mailing List,Third Party Advisory,VDB Entry
http://packetstormsecurity.com/files/167500/Verbatim-Store-N-Go-Secure-Portable-HDD-GD25LK01-3637-C-VER4.0-Risky-Crypto.html Exploit,Mailing List,Third Party Advisory,VDB Entry
http://packetstormsecurity.com/files/167528/Verbatim-Executive-Fingerprint-Secure-SSD-GDMSFE01-INI3637-C-VER1.1-Risky-Crypto.html Exploit,Mailing List,Third Party Advisory,VDB Entry
http://packetstormsecurity.com/files/167532/Verbatim-Fingerprint-Secure-Portable-Hard-Drive-53650-Risky-Crypto.html Exploit,Mailing List,Third Party Advisory,VDB Entry
http://seclists.org/fulldisclosure/2022/Jun/18 Exploit,Mailing List,Third Party Advisory
http://seclists.org/fulldisclosure/2022/Jun/22 Exploit,Mailing List,Third Party Advisory
http://seclists.org/fulldisclosure/2022/Jun/24 Exploit,Mailing List,Third Party Advisory
http://seclists.org/fulldisclosure/2022/Jun/9 Exploit,Mailing List,Third Party Advisory
http://seclists.org/fulldisclosure/2022/Oct/4 Mailing List,Third Party Advisory
https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2022-002.txt Exploit,Third Party Advisory
https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2022-006.txt Exploit,Third Party Advisory
https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2022-010.txt Exploit,Third Party Advisory
https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2022-015.txt Exploit,Third Party Advisory
https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2022-044.txt Exploit,Third Party Advisory
http://packetstormsecurity.com/files/167491/Verbatim-Keypad-Secure-USB-3.2-Gen-1-Drive-ECB-Issue.html Exploit,Mailing List,Third Party Advisory,VDB Entry
http://packetstormsecurity.com/files/167500/Verbatim-Store-N-Go-Secure-Portable-HDD-GD25LK01-3637-C-VER4.0-Risky-Crypto.html Exploit,Mailing List,Third Party Advisory,VDB Entry
http://packetstormsecurity.com/files/167528/Verbatim-Executive-Fingerprint-Secure-SSD-GDMSFE01-INI3637-C-VER1.1-Risky-Crypto.html Exploit,Mailing List,Third Party Advisory,VDB Entry
http://packetstormsecurity.com/files/167532/Verbatim-Fingerprint-Secure-Portable-Hard-Drive-53650-Risky-Crypto.html Exploit,Mailing List,Third Party Advisory,VDB Entry
http://seclists.org/fulldisclosure/2022/Jun/18 Exploit,Mailing List,Third Party Advisory
http://seclists.org/fulldisclosure/2022/Jun/22 Exploit,Mailing List,Third Party Advisory
http://seclists.org/fulldisclosure/2022/Jun/24 Exploit,Mailing List,Third Party Advisory
http://seclists.org/fulldisclosure/2022/Jun/9 Exploit,Mailing List,Third Party Advisory
http://seclists.org/fulldisclosure/2022/Oct/4 Mailing List,Third Party Advisory
https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2022-002.txt Exploit,Third Party Advisory
https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2022-006.txt Exploit,Third Party Advisory
https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2022-010.txt Exploit,Third Party Advisory
https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2022-015.txt Exploit,Third Party Advisory
https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2022-044.txt Exploit,Third Party Advisory

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2022-28382, you might also want to check these: