PatchTheCVECVE-2022-28382: An issue was discovered in certain Verbatim drives through 2022-03-31
CVE-2022-28382 is a high-severity flaw (CVSS 7.5) affecting keypad secure usb 3.2 gen 1 firmware, store \'n\' go secure portable hdd firmware, executive fingerprint secure ssd firmware. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
An issue was discovered in certain Verbatim drives through 2022-03-31. Due to the use of an insecure encryption AES mode (Electronic Codebook, aka ECB), an attacker may be able to extract information even from encrypted data, for example by observing repeating byte patterns. The firmware of the USB-to-SATA bridge controller INIC-3637EN uses AES-256 with the ECB mode. This operation mode of block ciphers (e.g., AES) always encrypts identical plain
Why this priority
- High severity
- Public exploit reference
- Remotely exploitable, no login, no user action
A fixed release or distro patch exists.
Risk facts
| CVSS score | 7.5 (High) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | None |
| User interaction | None |
| EPSS exploit chance | 1.8% (top 22%) |
| CISA exploited list | No |
| Weakness | CWE-327 |
| Published | 2022-06-08 |
| Last modified | 2026-06-17 |
Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2022-28382?
keypad secure usb 3.2 gen 1 firmware: upgrade to newer than 2022-03-31; store \'n\' go secure portable hdd firmware: upgrade to newer than 2022-03-31; executive fingerprint secure ssd firmware: upgrade to newer than 2022-03-31. Exact commands for each OS are on this page.
Is CVE-2022-28382 being exploited?
CVE-2022-28382 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2022-28382 affect?
CVE-2022-28382 affects keypad secure usb 3.2 gen 1 firmware, store \'n\' go secure portable hdd firmware, executive fingerprint secure ssd firmware. Severity is high (CVSS 7.5). An issue was discovered in certain Verbatim drives through 2022-03-31. Due to the use of an insecure encryption AES mode (Electronic Codebook, aka ECB), an attacker may be able to extract information even from encrypted data, for example by
How urgent is CVE-2022-28382?
Priority 56/100. High severity; Public exploit reference; Remotely exploitable, no login, no user action
Related CVEs
- CVE-2022-28386 MEDIUM 4.6 UPGRADE UPGRADE An issue was discovered in certain Verbatim drives through 2022-03-31
- CVE-2022-28384 MEDIUM 5.5 UPGRADE UPGRADE An issue was discovered in certain Verbatim drives through 2022-03-31
- CVE-2022-28383 MEDIUM 6.8 UPGRADE UPGRADE An issue was discovered in certain Verbatim drives through 2022-03-31