Self-Encrypting Drive Vulnerability in Samsung and Seagate Products
CVE-2015-7268

4.2MEDIUM

Key Information:

Vendor
Samsung
Status
850 Pro Firmware
Vendor
CVE Published:
27 November 2017

Summary

The vulnerability allows attackers with physical access to bypass the self-encrypting drive (SED) protection in specific Samsung and Seagate products. This is achieved by performing a forced restart and booting from an alternative operating system. Affected devices include Samsung 850 Pro and PM851 SSDs and Seagate ST500LT015 and ST500LT025 HDDs, particularly on Lenovo and Dell laptops with certain BIOS versions. This poses a significant risk, as it undermines the security mechanisms intended to protect sensitive data on these drives.

References

https://www.infoworld.com/article/3004913/encryption/self...
x_refsource_MISC
https://www.blackhat.com/docs/eu-15/materials/eu-15-Botea...
x_refsource_MISC

CVSS V3.1

Score:
4.2
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Physical
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.