What’s Vulnerable › Vulnerabilities
CVE-2021-36750
- Severity: high (CVSS 8.1 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 13.5% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2021-12-22 · updated 2026-06-17
- Weakness: CWE-307
Description
ENC DataVault before 7.2 and VaultAPI v67 mishandle key derivation, making it easier for attackers to determine the passwords of all DataVault users (across USB drives sold under multiple brand names).
Affected products
- SanDisk Secureaccess: 3.02
- Zendesk Enc Datavault: before 7.2 — fixed in 7.2
- Zendesk Enc Vaultapi: before 67.0 — fixed in 67.0
How to fix
Upgrade to a fixed version: Zendesk Enc Datavault 7.2; Zendesk Enc Vaultapi 67.0. Check the vendor advisory for mitigations.
References
- https://encsecurity.zendesk.com/hc/en-us/articles/4413283717265-Update-for-ENC-Software
- https://pretalx.c3voc.de/rc3-2021-r3s/talk/QMYGR3/
- https://www.encsecurity.com/solutions.php
- https://www.westerndigital.com/en-ap/support/product-security/wdc-21014-sandisk-secureaccess-software-update
- https://encsecurity.zendesk.com/hc/en-us/articles/4413283717265-Update-for-ENC-Software
- https://pretalx.c3voc.de/rc3-2021-r3s/talk/QMYGR3/
- https://www.encsecurity.com/solutions.php
- https://www.westerndigital.com/en-ap/support/product-security/wdc-21014-sandisk-secureaccess-software-update
Get alerted when CVE-2021-36750 or the next vulnerability affects your stack