What’s Vulnerable › Vulnerabilities

CVE-2018-12037

• Severity: medium (CVSS 4.0 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2018-11-20 · updated 2026-06-17

Description

An issue was discovered on Samsung 840 EVO and 850 EVO devices (only in "ATA high" mode, not vulnerable in "TCG" or "ATA max" mode), Samsung T3 and T5 portable drives, and Crucial MX100, MX200 and MX300 devices. Absence of a cryptographic link between the password and the Disk Encryption Key allows attackers with privileged access to SSD firmware full access to encrypted data.

Affected products

• Micron Crucial Mx100 Firmware: all versions
• Micron Crucial Mx200 Firmware: all versions
• Micron Crucial Mx300 Firmware: all versions
• Samsung 840 Evo Firmware: all versions
• Samsung 850 Evo Firmware: all versions
• Samsung T3 Firmware: all versions
• Samsung T5 Firmware: all versions

References

• http://www.securityfocus.com/bid/105840
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/ADV180028
• https://security.netapp.com/advisory/ntap-20181112-0001/
• http://www.securityfocus.com/bid/105840
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/ADV180028
• https://security.netapp.com/advisory/ntap-20181112-0001/

Get alerted when CVE-2018-12037 or the next vulnerability affects your stack