CVE-2019-10705

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Western Digital SanDisk X600 devices in certain configurations, a vulnerability in the access control mechanism of the drive may allow data to be decrypted without knowledge of proper authentication credentials.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-522

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://support.wdc.com/cat_products.aspx?ID=6&lang=enProduct, Vendor Advisory
https://www.westerndigital.com/support/productsecurity/wdc-19006-sandisk-x600-sata-ssdVendor Advisory
https://www.westerndigital.com/support/productsecurity/wdc-19007-sandisk-x300-x400-sata-ssdNot Applicable
https://support.wdc.com/cat_products.aspx?ID=6&lang=enProduct, Vendor Advisory
https://www.westerndigital.com/support/productsecurity/wdc-19006-sandisk-x600-sata-ssdVendor Advisory
https://www.westerndigital.com/support/productsecurity/wdc-19007-sandisk-x300-x400-sata-ssdNot Applicable

Timeline

Published: Mar 10, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-107066.3Western Digital SanDisk SanDisk X300, X300s, X400, and X600 devices: The firmware update authentication method relies on a symmetric HMAC di CVE-2019-107079.8MKCMS V5.0 has SQL injection via the bplay.php play parameter.CVE-2019-107089.8S-CMS PHP v1.0 has SQL injection via the 4/js/scms.php?action=unlike id parameter.CVE-2019-107099.8AsusPTPFilter.sys on Asus Precision TouchPad 11.0.0.25 hardware has a Pool Overflow associated with the \\.\AsusTP device, leading to a DoS CVE-2019-10715.5An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory, aka 'Windows Kernel Information CVE-2019-107108.8Insecure permissions in the Web management portal on all IP cameras based on Hisilicon Hi3510 firmware allow authenticated attackers to rece CVE-2019-107117.5Incorrect access control in the RTSP stream and web portal on all IP cameras based on Hisilicon Hi3510 firmware (until Webware version V1.0.CVE-2019-107129.8The Web-GUI on WAGO Series 750-88x (750-330, 750-352, 750-829, 750-831, 750-852, 750-880, 750-881, 750-882, 750-884, 750-885, 750-889) and S CVE-2019-107146.5LocaleLowercase in MagickCore/locale.c in ImageMagick before 7.0.8-32 allows out-of-bounds access, leading to a SIGSEGV.CVE-2019-107155.4There is Stored XSS in Verodin Director 3.5.3.0 and earlier via input fields of certain tooltips, and on the Tags, Sequences, and Actors pag CVE-2019-107167.7An Information Disclosure issue in Verodin Director 3.5.3.1 and earlier reveals usernames and passwords of integrated security technologies CVE-2019-107177.1BlogEngine.NET 3.3.7.0 allows /api/filemanager Directory Traversal via the path parameter.