What’s Vulnerable › Vulnerabilities

CVE-2019-10706

• Severity: medium (CVSS 6.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2020-03-10 · updated 2026-06-17
• Weakness: CWE-522

Description

Western Digital SanDisk SanDisk X300, X300s, X400, and X600 devices: The firmware update authentication method relies on a symmetric HMAC digest. The key used to validate this digest is present in a protected area of the device, and if extracted could be used to install arbitrary firmware to other devices.

Affected products

• Westerndigital Sandisk X300 Sd7Sb6S-128G Firmware: all versions
• Westerndigital Sandisk X300 Sd7Sb6S-256G Firmware: all versions
• Westerndigital Sandisk X300 Sd7Sb7S-010T Firmware: all versions
• Westerndigital Sandisk X300 Sd7Sb7S-512G Firmware: all versions
• Westerndigital Sandisk X300 Sd7Sf6S-128G Firmware: all versions
• Westerndigital Sandisk X300 Sd7Sf6S-256G Firmware: all versions
• Westerndigital Sandisk X300 Sd7Sf6S-512G Firmware: all versions
• Westerndigital Sandisk X300 Sd7Sn6S-128G Firmware: all versions
• Westerndigital Sandisk X300 Sd7Sn6S-256G Firmware: all versions
• Westerndigital Sandisk X300 Sd7Sn6S-512G Firmware: all versions
• Westerndigital Sandisk X300S Sd7Sb3Q-064G Firmware: all versions
• Westerndigital Sandisk X300S Sd7Sn3Q-064G Firmware: all versions
• Westerndigital Sandisk X300S Sd7Ub2Q-010T Firmware: all versions
• Westerndigital Sandisk X300S Sd7Ub2Q-512G Firmware: all versions
• Westerndigital Sandisk X300S Sd7Ub3Q-128G Firmware: all versions
• Westerndigital Sandisk X300S Sd7Ub3Q-256G Firmware: all versions
• Westerndigital Sandisk X300S Sd7Un3Q-128G Firmware: all versions
• Westerndigital Sandisk X300S Sd7Un3Q-256G Firmware: all versions
• Westerndigital Sandisk X300S Sd7Un3Q-512G Firmware: all versions
• Westerndigital Sandisk X400 Sd8Sb8U-128G-1122 Firmware: all versions
• Westerndigital Sandisk X400 Sd8Sb8U-128G Firmware: all versions
• Westerndigital Sandisk X400 Sd8Sb8U-1T00-1122 Firmware: all versions
• Westerndigital Sandisk X400 Sd8Sb8U-1T00 Firmware: all versions
• Westerndigital Sandisk X400 Sd8Sb8U-256G-1122 Firmware: all versions
• Westerndigital Sandisk X400 Sd8Sb8U-256G Firmware: all versions
• Westerndigital Sandisk X400 Sd8Sb8U-512G-1122 Firmware: all versions
• Westerndigital Sandisk X400 Sd8Sb8U-512G Firmware: all versions
• Westerndigital Sandisk X400 Sd8Sn8U-128G-1122 Firmware: all versions
• Westerndigital Sandisk X400 Sd8Sn8U-128G Firmware: all versions
• Westerndigital Sandisk X400 Sd8Sn8U-1T00-1122 Firmware: all versions

How to fix

Upgrade to a fixed version: Westerndigital Sandisk X600 Sd9Sb8W-128G Firmware x6112100; Westerndigital Sandisk X600 Sd9Sb8W-1T00 Firmware x6112100; Westerndigital Sandisk X600 Sd9Sb8W-256G Firmware x6112100; Westerndigital Sandisk X600 Sd9Sb8W-2T00 Firmware x6112100; Westerndigital Sandisk X600 Sd9Sb8W-512G Firmware x6112100; Westerndigital Sandisk X600 Sd9Sn8W-128G Firmware x6112100; Westerndigital Sandisk X600 Sd9Sn8W-1T00 Firmware x6112100; Westerndigital Sandisk X600 Sd9Sn8W-256G Firmware x6112100; Westerndigital Sandisk X600 Sd9Sn8W-2T00 Firmware x6112100; Westerndigital Sandisk X600 Sd9Sn8W-512G Firmware x6112100; Westerndigital Sandisk X600 Sd9Tb8W-128G Firmware x6112100; Westerndigital Sandisk X600 Sd9Tb8W-1T00 Firmware x6112100. Check the vendor advisory for mitigations.

References

• https://support.wdc.com/cat_products.aspx?ID=6&lang=en
• https://www.westerndigital.com/support/productsecurity/wdc-19006-sandisk-x600-sata-ssd
• https://www.westerndigital.com/support/productsecurity/wdc-19007-sandisk-x300-x400-sata-ssd
• https://support.wdc.com/cat_products.aspx?ID=6&lang=en
• https://www.westerndigital.com/support/productsecurity/wdc-19006-sandisk-x600-sata-ssd
• https://www.westerndigital.com/support/productsecurity/wdc-19007-sandisk-x300-x400-sata-ssd

Get alerted when CVE-2019-10706 or the next vulnerability affects your stack