Western Digital Vulnerabilities and Affected Products
Vulnerabilities associated with My Cloud Home and My Cloud Home Duo.
Products
Clear product- My Cloud14 vulnerabilities
- My Cloud OS 512 vulnerabilities
- My Cloud Home6 vulnerabilities
- My Cloud Home and My Cloud Home Duo6 vulnerabilities
- Sweet B Library4 vulnerabilities
- WD Discovery3 vulnerabilities
- My Cloud Home & Duo2 vulnerabilities
- My Cloud Home Web App2 vulnerabilities
- EdgeRover1 vulnerability
- My Cloud Home Duo1 vulnerability
- My Cloud Home Mobile App1 vulnerability
- My Cloud OS 5 Mobile App1 vulnerability
- My Cloud OS 5 Web App1 vulnerability
- My Cloud web app1 vulnerability
- my_book_live_firmware1 vulnerability
- my_cloud_pr4100_firmware1 vulnerability
- mycloud_nas1 vulnerability
- TV Live Hub1 vulnerability
- TV Media Player1 vulnerability
- WD Cloud web app1 vulnerability
- wd_my_book_live_firmware1 vulnerability
| Vulnerability | Title and context | CVSS | EPSS | PoCs | Signals | STIX action |
|---|---|---|---|---|---|---|
CVE-2022-36331CRITICAL | Impersonation attack causing an Authentication Bypass on Western Digital devicesWestern Digital My Cloud, My Cloud Home, My Cloud Home Duo, and SanDisk ibi devices were vulnerable to an impersonation attack that could allow an unauthenticated attacker to gain access to user data. This issue affects My Cloud OS 5 devices: before 5.25.132; My Cloud Home and My Cloud Home Duo: before 8.13.1-102; SanDisk ibi: before 8.13.1-102. CWE-290Jun 12, 2023 | CVSS10.0v3.1 | EPSS0.591% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2022-36328MEDIUM | Path Traversal Vulnerability leading to an arbitrary file read in Western Digital devicesImproper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could allow an attacker to create arbitrary shares on arbitrary directories and exfiltrate sensitive files, passwords, users and device configurations was discovered in Western Digital My Cloud Home, My Cloud Home Duo, SanDisk ibi and Western Digital My Cloud OS 5 devices. This can only be exploited once an attacker gains root privileges on the devices using an authentication bypass issue or another… CWE-22May 18, 2023 | CVSS5.8v3.1 | EPSS0.767% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2022-36327MEDIUM | Path traversal vulnerability leading to an arbitrary file write in Western Digital devicesImproper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could allow an attacker to write files to locations with certain critical filesystem types leading to remote code execution was discovered in Western Digital My Cloud Home, My Cloud Home Duo, SanDisk ibi and Western Digital My Cloud OS 5 devices. This issue requires an authentication bypass issue to be triggered before this can be exploited. This issue affects My Cloud Home and My Cloud Home Duo: b… CWE-22May 18, 2023 | CVSS5.8v3.1 | EPSS1.47% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2022-36326MEDIUM | Resource Exhaustion Vulnerability in Western Digital devicesAn uncontrolled resource consumption vulnerability issue that could arise by sending crafted requests to a service to consume a large amount of memory, eventually resulting in the service being stopped and restarted was discovered in Western Digital My Cloud Home, My Cloud Home Duo, SanDisk ibi and Western Digital My Cloud OS 5 devices. This issue requires the attacker to already have root privileges in order to exploit this vulnerability.This issue affects My Cloud Home and My Cloud Home Duo: b… CWE-400May 18, 2023 | CVSS4.4v3.1 | EPSS0.572% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2022-36329MEDIUM | Denial of Service over OTA mechanism in Western Digital My Cloud Home and ibi devicesAn improper privilege management issue that could allow an attacker to cause a denial of service over the OTA mechanism was discovered in Western Digital My Cloud Home, My Cloud Home Duo and SanDisk ibi devices.This issue affects My Cloud Home and My Cloud Home Duo: before 9.4.0-191; ibi: before 9.4.0-191. CWE-400May 10, 2023 | CVSS4.4v3.1 | EPSS0.296% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
Buffer Overflow Vulnerability in Western Digital My Cloud Home and ibi devicesA buffer overflow vulnerability was discovered on firmware version validation that could lead to an unauthenticated remote code execution in Western Digital My Cloud Home, My Cloud Home Duo and SanDisk ibi devices. An attacker would require exploitation of another vulnerability to raise their privileges in order to exploit this buffer overflow vulnerability. This issue affects My Cloud Home and My Cloud Home Duo: before 9.4.0-191; ibi: before 9.4.0-191. CWE-120May 9, 2023 | CVSS1.9v3.1 | EPSS0.557% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |