CVE-2022-28384 in Keypad Secure USB 3.2 Gen 1 Drive
Summary
by MITRE • 06/08/2022
An issue was discovered in certain Verbatim drives through 2022-03-31. Due to an insecure design, they allow an offline brute-force attack for determining the correct passcode, and thus gaining unauthorized access to the stored encrypted data. This affects Keypad Secure USB 3.2 Gen 1 Drive Part Number #49428 and Store 'n' Go Secure Portable HDD GD25LK01-3637-C VER4.0.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 05/19/2026
The vulnerability identified in CVE-2022-28384 represents a critical weakness in the cryptographic design of certain Verbatim secure storage devices, specifically targeting the Keypad Secure USB 3.2 Gen 1 Drive and Store 'n' Go Secure Portable HDD models. This issue stems from an insecure implementation that fundamentally compromises the security model of the device's passcode protection mechanism, creating a pathway for unauthorized access to encrypted data through offline brute-force attacks.
The technical flaw manifests in the device's passcode validation process, where the cryptographic implementation fails to properly enforce rate limiting or account lockout mechanisms during authentication attempts. This design weakness allows an attacker with physical access to the device to systematically test passcode combinations without triggering protective measures that would normally prevent rapid successive attempts. The vulnerability specifically affects devices with firmware versions up to 2022-03-31, indicating that the insecure design was present in the device's cryptographic implementation rather than being a temporary software bug.
From an operational perspective, this vulnerability creates a severe risk for users who store sensitive data on these devices, as it effectively nullifies the encryption protection that users rely upon for data security. The offline nature of the attack means that even if devices are not connected to networks or systems, an attacker with physical possession can still recover the stored data through systematic passcode guessing. This represents a fundamental failure in the device's security architecture and violates core principles of cryptographic system design that require authentication mechanisms to be resistant to brute-force attacks.
The security implications extend beyond simple data theft to include potential corporate espionage, identity theft, and compliance violations for organizations that store sensitive information on these devices. The vulnerability aligns with CWE-310, which addresses cryptographic weaknesses in authentication mechanisms, and demonstrates a failure to implement proper authentication strengthening techniques such as account lockout policies or exponential backoff mechanisms. From an ATT&CK framework perspective, this vulnerability maps to T1212, which covers the exploitation of software vulnerabilities for credential access, and T1567, which addresses the use of brute force techniques to gain access to systems.
Organizations and individuals using affected Verbatim devices should immediately implement mitigation strategies including changing passcodes to complex combinations, implementing additional access controls, and considering alternative secure storage solutions. The vendor should provide firmware updates to address the design flaw, though the fundamental issue lies in the device architecture itself rather than a simple software patch. Users should also consider the broader implications of relying on devices with such fundamental security weaknesses and evaluate their data protection strategies accordingly. The vulnerability serves as a reminder of the importance of proper cryptographic design and the need for authentication mechanisms to be resilient against offline attack scenarios.