{"id":"CVE-2021-36750","aliases":["EUVD-2021-23339","GHSA-pj9c-cg8c-hvp4"],"status":"published","title":"ENC DataVault 7.1.1W and VaultAPI v67, which is currently being used in various other...","description":"ENC DataVault before 7.2 and VaultAPI v67 mishandle key derivation, making it easier for attackers to determine the passwords of all DataVault users (across USB drives sold under multiple brand names).","severity":{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-12","score":0.13526,"percentile":0.96503,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-307"],"published":"2021-12-22T13:40:32Z","modified":"2026-06-17T03:59:06Z","exploits":[{"source":"pocgithub","id":"mamba-4-ever/CVE-2021-36750","title":"mamba-4-ever/CVE-2021-36750","date":"2021-12-02","url":"https://github.com/mamba-4-ever/CVE-2021-36750"}],"products":[{"vendor":"sandisk","product":"secureaccess"},{"vendor":"zendesk","product":"enc_datavault"},{"vendor":"zendesk","product":"enc_vaultapi"}],"references":[{"url":"https://www.encsecurity.com/solutions.php","tags":["x_refsource_MISC","x_transferred","Product"]},{"url":"https://encsecurity.zendesk.com/hc/en-us/articles/4413283717265-Update-for-ENC-Software","tags":["x_refsource_MISC","x_transferred","Vendor Advisory"]},{"url":"https://www.westerndigital.com/en-ap/support/product-security/wdc-21014-sandisk-secureaccess-software-update","tags":["x_refsource_MISC","x_transferred","Third Party Advisory"]},{"url":"https://pretalx.c3voc.de/rc3-2021-r3s/talk/QMYGR3/","tags":["x_refsource_MISC","x_transferred","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-36750"},{"url":"https://github.com/advisories/GHSA-pj9c-cg8c-hvp4"}],"sources":{"cve":[{"id":"CVE-2021-36750","description":"ENC DataVault before 7.2 and VaultAPI v67 mishandle key derivation, making it easier for attackers to determine the passwords of all DataVault users (across USB drives sold under multiple brand names).","status":"published","published":"2021-12-22T13:40:32Z","modified":"2024-08-04T01:01:59.308Z","updated_at":"2026-11-02T14:33:05.989686Z"}],"euvd":[{"id":"EUVD-2021-23339","description":"ENC DataVault before 7.2 and VaultAPI v67 mishandle key derivation, making it easier for attackers to determine the passwords of all DataVault users (across USB drives sold under multiple brand names).","status":"published","published":"2021-12-22T13:40:32Z","modified":"2024-08-04T01:01:59Z","updated_at":"2026-11-03T03:24:29.329171Z"}],"ghsa":[{"id":"GHSA-pj9c-cg8c-hvp4","title":"ENC DataVault 7.1.1W and VaultAPI v67, which is currently being used in various other...","description":"ENC DataVault 7.1.1W and VaultAPI v67, which is currently being used in various other applications, mishandles key derivation, making it easier for attackers to determine the passwords of all DataVault users (across USB drives sold under multiple brand names).","status":"published","published":"2021-12-23T00:01:33Z","modified":"2023-02-03T05:03:22Z","cwes":["CWE-307"],"updated_at":"2026-11-02T14:53:20.596522Z"}],"nvd":[{"id":"CVE-2021-36750","description":"ENC DataVault before 7.2 and VaultAPI v67 mishandle key derivation, making it easier for attackers to determine the passwords of all DataVault users (across USB drives sold under multiple brand names).","status":"published","published":"2021-12-22T14:15:07.573Z","modified":"2026-06-17T03:59:06.493Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"primary"},{"version":"2.0","score":5.5,"vector":"AV:N/AC:L/Au:S/C:P/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-307"],"updated_at":"2026-11-02T14:07:02.566991Z"}]}}