4

CVE-2018-12037

An issue was discovered on Samsung 840 EVO and 850 EVO devices (only in "ATA high" mode, not vulnerable in "TCG" or "ATA max" mode), Samsung T3 and T5 portable drives, and Crucial MX100, MX200 and MX300 devices. Absence of a cryptographic link between the password and the Disk Encryption Key allows attackers with privileged access to SSD firmware full access to encrypted data.

Data is provided by the National Vulnerability Database (NVD)
Samsung ≫ 840 Evo Firmware Version-
   Samsung ≫ 840 Evo Version-
Samsung ≫ 850 Evo Firmware Version-
   Samsung ≫ 850 Evo Version-
Samsung ≫ T3 Firmware Version-
   Samsung ≫ T3 Version-
Samsung ≫ T5 Firmware Version-
   Samsung ≫ T5 Version-
Micron ≫ Crucial Mx100 Firmware Version-
   Micron ≫ Crucial Mx100 Version-
Micron ≫ Crucial Mx200 Firmware Version-
   Micron ≫ Crucial Mx200 Version-
Micron ≫ Crucial Mx300 Firmware Version-
   Micron ≫ Crucial Mx300 Version-
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 0.15% 0.367
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
nvd@nist.gov 4 0.4 3.6
CVSS:3.0/AV:P/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
nvd@nist.gov 1.9 3.4 2.9
AV:L/AC:M/Au:N/C:P/I:N/A:N
http://www.securityfocus.com/bid/105840
Third Party Advisory
VDB Entry