CVE-2024-22170: Unchecked buffer in Dynamic DNS client

Record summary

CVE-2024-22170 has a selected CVSS score of 9.2 (critical).

Description

Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in Western Digital My Cloud ddns-start on Linux allows Overflow Buffers.This issue affects My Cloud: before 5.29.102.

Description source: CVE List

Exploitation context

CISA SSVC decision

ExploitationNone

AutomatableNo

Technical impactTotal

CISA Coordinator · SSVC 2.0.3 · Evaluated Sep 27, 2024 · Source: CVE List

Affected products and versions

Product	Source	Version range	Status
My Cloud Browse Western Digital / My Cloudddns-start Default status: unaffected	CVE List	Before 5.29.102	affected
my_cloud_dl2100_firmware Browse westerndigital / my_cloud_dl2100_firmware Default status: unknown	CVE List	Before 5.29.102	affected
my_cloud_dl4100_firmware Browse westerndigital / my_cloud_dl4100_firmware Default status: unknown	CVE List	Before 5.29.102	affected
my_cloud_ex2100_firmware Browse westerndigital / my_cloud_ex2100_firmware Default status: unknown	CVE List	Before 5.29.102	affected
my_cloud_ex2_ultra_firmware Browse westerndigital / my_cloud_ex2_ultra_firmware Default status: unknown	CVE List	Before 5.29.102	affected
my_cloud_ex4100_firmware Browse westerndigital / my_cloud_ex4100_firmware Default status: unknown	CVE List	Before 5.29.102	affected
my_cloud_firmware Browse westerndigital / my_cloud_firmware Default status: unknown	CVE List	Before 5.29.102	affected
my_cloud_mirror_g2_firmware Browse westerndigital / my_cloud_mirror_g2_firmware Default status: unknown	CVE List	Before 5.29.102	affected
my_cloud_pr2100_firmware Browse westerndigital / my_cloud_pr2100_firmware Default status: unknown	CVE List	Before 5.29.102	affected
my_cloud_pr4100_firmware Browse westerndigital / my_cloud_pr4100_firmware Default status: unknown	CVE List	Before 5.29.102	affected
wd_cloud_firmware Browse westerndigital / wd_cloud_firmware Default status: unknown	CVE List	Before 5.29.102	affected

References

nvd.nist.gov

https://nvd.nist.gov/vuln/detail/CVE-2024-22170

westerndigital.comVendor advisory

https://www.westerndigital.com/support/product-security/wdc-24005-western-digital-my-cloud-os-5-firmware-5-29-102

CVE-2024-22170

Record summary

Description

Exploitation context

CISA SSVC decision

Affected products and versions

My Cloud

my_cloud_dl2100_firmware

my_cloud_dl4100_firmware

my_cloud_ex2100_firmware

my_cloud_ex2_ultra_firmware

my_cloud_ex4100_firmware

my_cloud_firmware

my_cloud_mirror_g2_firmware

my_cloud_pr2100_firmware

my_cloud_pr4100_firmware

wd_cloud_firmware

References