Vulnerability · Published Sep 19, 2022 · Assigned by WDC PSIRT
CVE-2022-29835WD Discovery's Use of Weak Hashing Algorithm for Code Signing
Medium 5.3
In plain English
A medium-severity security flaw in WD Discovery from Western Digital. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 10% of all known vulnerabilities).
Official description
WD Discovery software executable files were signed with an unsafe SHA-1 hashing algorithm. An attacker could use this weakness to create forged certificate signatures due to the use of a hashing algorithm that is not collision-free. This could thereby impact the confidentiality of user content. This issue affects: Western Digital WD Discovery WD Discovery Desktop App versions prior to 4.4.396 on Mac; WD Discovery Desktop App versions prior to 4.4.396 on Windows.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Western Digital | WD Discovery | WD Discovery Desktop App – before 4.4.396 |
| Western Digital | WD Discovery | WD Discovery Desktop App – before 4.4.396 |
Weakness: CWE-328 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N