CVE-2022-28383 : Security Advisory and Response

An issue was discovered in certain Verbatim drives through 2022-03-31. Due to insufficient firmware validation, an attacker can store malicious firmware code for the USB-to-SATA bridge controller on the USB drive (e.g., by leveraging physical access during the supply chain). This code is then executed. This affects Keypad Secure USB 3.2 Gen 1 Drive Part Number #49428, Store 'n' Go Secure Portable HDD GD25LK01-3637-C VER4.0, Executive Fingerprint Secure SSD GDMSFE01-INI3637-C VER1.1, and Fingerprint Secure Portable Hard Drive Part Number #53650.

Understanding CVE-2022-28383

This section provides insight into the nature of the vulnerability and its potential impact.

What is CVE-2022-28383?

CVE-2022-28383 pertains to a flaw in certain Verbatim drives that allows an attacker to store and execute malicious firmware code on the USB drive's USB-to-SATA bridge controller due to inadequate firmware validation.

The Impact of CVE-2022-28383

This vulnerability can be exploited to introduce malicious code into the affected Verbatim drives, potentially leading to unauthorized access or control over the device by an attacker.

Technical Details of CVE-2022-28383

Explore the specifics of the vulnerability, the systems affected, and how it can be exploited.

Vulnerability Description

The vulnerability arises from insufficient firmware validation in the affected Verbatim drives, enabling an attacker to introduce and execute malicious firmware code.

Affected Systems and Versions

The vulnerability impacts Verbatim drives including Keypad Secure USB 3.2 Gen 1 Drive Part Number #49428, Store 'n' Go Secure Portable HDD GD25LK01-3637-C VER4.0, Executive Fingerprint Secure SSD GDMSFE01-INI3637-C VER1.1, and Fingerprint Secure Portable Hard Drive Part Number #53650.

Exploitation Mechanism

Attackers can leverage physical access during the supply chain phase to store malicious firmware code on the USB drive's controller, which is then executed upon connection.

Mitigation and Prevention

Learn how to address and prevent vulnerabilities like CVE-2022-28383 for enhanced cybersecurity.

Immediate Steps to Take

Immediately updating firmware, restricting physical access, and monitoring for unauthorized activity can mitigate the risk associated with CVE-2022-28383.

Long-Term Security Practices

Implementing secure firmware validation processes, conducting regular security audits, and educating personnel on cybersecurity best practices contribute to long-term security.

Patching and Updates

Stay informed about security updates and patches provided by Verbatim to address the vulnerability and enhance the security posture of the affected devices.