ENC DataVault 7.1.1W uses an inappropriate encryption... · CVE-2021-36751 · GitHub Advisory Database · GitHub

ENC DataVault 7.1.1W uses an inappropriate encryption...

Critical severity Unreviewed Published Jan 3, 2022 to the GitHub Advisory Database • Updated Jan 29, 2023

Package

No package listed— Suggest a package

Affected versions

Unknown

Patched versions

Unknown

Description

ENC DataVault 7.1.1W uses an inappropriate encryption algorithm, such that an attacker (who does not know the secret key) can make ciphertext modifications that are reflected in modified plaintext. There is no data integrity mechanism. (This behavior occurs across USB drives sold under multiple brand names.)

References

Published by the National Vulnerability Database

Jan 2, 2022

Published to the GitHub Advisory Database Jan 3, 2022

Last updated Jan 29, 2023

Severity

Critical

9.1

/ 10

CVSS base metrics

Attack vector

Network

Attack complexity

Low

Privileges required

None

User interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N