PatchTheCVECVE-2022-28387: An issue was discovered in certain Verbatim drives through 2022-03-31
CVE-2022-28387 is a medium-severity flaw (CVSS 4.6) affecting executive fingerprint secure ssd firmware, fingerprint secure portable hard drive firmware. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
An issue was discovered in certain Verbatim drives through 2022-03-31. Due to an insecure design, they can be unlocked by an attacker who can then gain unauthorized access to the stored data. The attacker can simply use an undocumented IOCTL command that retrieves the correct password. This affects Executive Fingerprint Secure SSD GDMSFE01-INI3637-C VER1.1 and Fingerprint Secure Portable Hard Drive Part Number #53650.
Why this priority
- Public exploit reference
A fixed release or distro patch exists.
Risk facts
| CVSS score | 4.6 (Medium) |
| Attack vector | Physical |
| Attack complexity | Low |
| Privileges needed | None |
| User interaction | None |
| EPSS exploit chance | 0.5% (top 58%) |
| CISA exploited list | No |
| Published | 2022-06-08 |
| Last modified | 2026-06-17 |
Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2022-28387?
executive fingerprint secure ssd firmware: upgrade to newer than 2022-03-31; fingerprint secure portable hard drive firmware: upgrade to newer than 2022-03-31. Exact commands for each OS are on this page.
Is CVE-2022-28387 being exploited?
CVE-2022-28387 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2022-28387 affect?
CVE-2022-28387 affects executive fingerprint secure ssd firmware, fingerprint secure portable hard drive firmware. Severity is medium (CVSS 4.6). An issue was discovered in certain Verbatim drives through 2022-03-31. Due to an insecure design, they can be unlocked by an attacker who can then gain unauthorized access to the stored data. The attacker can simply use an undocumented IOCT
How urgent is CVE-2022-28387?
Priority 32/100. Public exploit reference
Related CVEs
- CVE-2022-28385 MEDIUM 4.6 UPGRADE UPGRADE An issue was discovered in certain Verbatim drives through 2022-03-31
- CVE-2022-28383 MEDIUM 6.8 UPGRADE UPGRADE An issue was discovered in certain Verbatim drives through 2022-03-31
- CVE-2022-28382 HIGH 7.5 UPGRADE UPGRADE An issue was discovered in certain Verbatim drives through 2022-03-31