WD Discovery, SanDisk ibi, and SanDisk Flashback - Local Escalation of Privileges
WDC Tracking Number: WDC-19015
Product Line/Web: WD Discovery, SanDisk ibi, SanDisk Flashback
Published: November 22, 2019
Last Updated: November 22, 2019
WD Discovery, SanDisk ibi, and SanDisk Flashback were vulnerable to a local escalation of privilege.
An API intended to support automatic software update incorrectly allowed arbitrary command execution. Additionally, privileged executables used to communicate with hardware devices were installed with incorrect permissions. The affected API has been removed and the privileged executables have been moved to a restricted directory.