A vulnerability was found in Western Digital WD Discovery Desktop App on Windows/Mac. It has been classified as problematic. Affected is an unknown functionality of the component Executable Files Parser. The manipulation with an unknown input leads to a use of weak hash vulnerability. CWE is classifying the issue as CWE-328. The product uses an algorithm that produces a digest (output value) that does not meet security expectations for a hash function that allows an adversary to reasonably determine the original input (preimage attack), find another input that can produce the same hash (2nd preimage attack), or find multiple inputs that evaluate to the same hash (birthday attack). This is going to have an impact on confidentiality. CVE summarizes:

WD Discovery software executable files were signed with an unsafe SHA-1 hashing algorithm. An attacker could use this weakness to create forged certificate signatures due to the use of a hashing algorithm that is not collision-free. This could thereby impact the confidentiality of user content. This issue affects: Western Digital WD Discovery WD Discovery Desktop App versions prior to 4.4.396 on Mac; WD Discovery Desktop App versions prior to 4.4.396 on Windows.

The weakness was disclosed 09/20/2022. The advisory is shared for download at westerndigital.com. This vulnerability is traded as CVE-2022-29835 since 04/27/2022. Successful exploitation requires user interaction by the victim. There are neither technical details nor an exploit publicly available. The MITRE ATT&CK project declares the attack technique as T1600.001.

Upgrading to version 4.4.396 eliminates this vulnerability.

Productinfo

Vendor

• Western Digital

Name

• WD Discovery Desktop App

License

• commercial

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion