PatchTheCVECVE-2022-28385: An issue was discovered in certain Verbatim drives through 2022-03-31
CVE-2022-28385 is a medium-severity flaw (CVSS 4.6) affecting executive fingerprint secure ssd firmware, fingerprint secure portable hard drive firmware. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
An issue was discovered in certain Verbatim drives through 2022-03-31. Due to missing integrity checks, an attacker can manipulate the content of the emulated CD-ROM drive (containing the Windows and macOS client software). The content of this emulated CD-ROM drive is stored as an ISO-9660 image in the hidden sectors of the USB drive, that can only be accessed using special IOCTL commands, or when installing the drive in an external disk enclosur
Why this priority
- Public exploit reference
A fixed release or distro patch exists.
Risk facts
| CVSS score | 4.6 (Medium) |
| Attack vector | Physical |
| Attack complexity | Low |
| Privileges needed | None |
| User interaction | None |
| EPSS exploit chance | 0.3% (top 75%) |
| CISA exploited list | No |
| Weakness | CWE-345 |
| Published | 2022-06-08 |
| Last modified | 2026-06-17 |
Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2022-28385?
executive fingerprint secure ssd firmware: upgrade to newer than 2022-03-31; fingerprint secure portable hard drive firmware: upgrade to newer than 2022-03-31. Exact commands for each OS are on this page.
Is CVE-2022-28385 being exploited?
CVE-2022-28385 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2022-28385 affect?
CVE-2022-28385 affects executive fingerprint secure ssd firmware, fingerprint secure portable hard drive firmware. Severity is medium (CVSS 4.6). An issue was discovered in certain Verbatim drives through 2022-03-31. Due to missing integrity checks, an attacker can manipulate the content of the emulated CD-ROM drive (containing the Windows and macOS client software). The content of t
How urgent is CVE-2022-28385?
Priority 27/100. Public exploit reference
Software pages
Windows vulnerabilities · macOS vulnerabilities
Related CVEs
- CVE-2022-28387 MEDIUM 4.6 UPGRADE UPGRADE An issue was discovered in certain Verbatim drives through 2022-03-31
- CVE-2022-28383 MEDIUM 6.8 UPGRADE UPGRADE An issue was discovered in certain Verbatim drives through 2022-03-31
- CVE-2022-28382 HIGH 7.5 UPGRADE UPGRADE An issue was discovered in certain Verbatim drives through 2022-03-31