Toshiba backup drives are not secure. Critical vulnerabilities in storage backup & security software, HDD Password tool

Cybersecurity specialists have revealed the presence of a potential security vulnerability in three backup and security software applications for Toshiba Canvio external hard drive product. For security, Toshiba advises administrators of the affected software to upgrade to the latest version, available on the company’s website.

This potential security flaw resides in Storage Backup Software, Storage Security Software and HDD Password Tool, all executables on Windows operating systems. These applications are designed to be used with these specific HDD products.


  • Storage Backup Software v1.30.9116 and earlier
  • Storage Security Software v1.30.8604 and earlier
  • HDD Password Tool, for Windows v1.20.6620 and earlier

Each application uses a search path that contains an element without quotation marks, consisting of white space or other separators. This can cause the product to access resources on a primary route, possibly allowing local privilege escalation.


For Storage Backup Software and Storage Security Software

Customers who have installed earlier versions of these applications are encouraged not to run them anymore. Instead, it is recommended to download the latest versions of the apps, available on the company’s official website. S

Some pre-upgrade configurations

Before upgrading these solutions, if you have a password-protected HDD with the software, delete the password before uninstalling.

For both storage backup software and storage backup software, be sure to back up all device data to another computer or storage medium before upgrading.

Storage Backup Software and Storage Security Software Update

When you connect your device to a computer where the previous version of the software is installed, the initiator will present you with an option to update the software.

Uninstalling Storage Backup Software and Storage Security Software

Before performing any activity, uninstall Storage Backup Software and Storage Security Software.

For the HDD Password Tool

Customers using version 1.20.6620 or earlier are encouraged to uninstall the software to avoid issues related to the vulnerability. A new update is expected to be available from April 28, 2020.

If you use them with the listed products, we recommend that you continue with the ‘Preparation No. 1 before uninstalling’ and ‘Uninstall software No. 2’ and then ‘Remove the HDD Password Tool installer file’.

If you use them with products other than those listed above, we recommend that you only continue with the uninstall software and the HDD Password Tool installation file below, and do not download a new software update.