CVEvulnerability
CVE-2021-36750
8.1 HIGH
Official page ↗
- Status
- Modified
- Published
- 2021-12-22
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 8.1 HIGH — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
- CVSS 2.0 ([email protected])
- 5.5 MEDIUM — AV:N/AC:L/Au:S/C:P/I:P/A:N
- Weaknesses
- CWE-307
Description
ENC DataVault before 7.2 and VaultAPI v67 mishandle key derivation, making it easier for attackers to determine the passwords of all DataVault users (across USB drives sold under multiple brand names).
Affected configurations
• zendesk enc datavault (< 7.2)
• zendesk enc vaultapi (< 67.0)
• sandisk secureaccess 3.02
Related
Weakness · CWE (1)
- CWE-307 Improper Restriction of Excessive Authentication Attempts weakness
References
- https://encsecurity.zendesk.com/hc/en-us/articles/4413283717265-Update-for-ENC-Software Vendor Advisory
- https://pretalx.c3voc.de/rc3-2021-r3s/talk/QMYGR3/ Third Party Advisory
- https://www.encsecurity.com/solutions.php Product
- https://www.westerndigital.com/en-ap/support/product-security/wdc-21014-sandisk-secureaccess-software-update Third Party Advisory
- https://encsecurity.zendesk.com/hc/en-us/articles/4413283717265-Update-for-ENC-Software Vendor Advisory
- https://pretalx.c3voc.de/rc3-2021-r3s/talk/QMYGR3/ Third Party Advisory
- https://www.encsecurity.com/solutions.php Product
- https://www.westerndigital.com/en-ap/support/product-security/wdc-21014-sandisk-secureaccess-software-update Third Party Advisory