CVE-2022-36331
Critical
Description
Western Digital My Cloud, My Cloud Home, My Cloud Home Duo, and SanDisk ibi devices were vulnerable to an impersonation attack that could allow an unauthenticated attacker to gain access to user data. This issue affects My Cloud OS 5 devices: before 5.25.132; My Cloud Home and My Cloud Home Duo: before 8.13.1-102; SanDisk ibi: before 8.13.1-102.
SeverityCritical
CVSS10.0
Exploit probability—
ProductWesterndigital Sandisk Ibi Firmware
PublishedJun 12, 2023
First seenJun 12, 2023
Weakness typeCWE-290CWE-290
How to fix
Update
- westerndigital sandisk_ibi_firmware8.13.1-102 or later
- westerndigital my_cloud_pr2100_firmware5.25.132 or later
- westerndigital my_cloud_pr4100_firmware5.25.132 or later
- westerndigital my_cloud_ex4100_firmware5.25.132 or later
- westerndigital my_cloud_ex2_ultra_firmware5.25.132 or later
- westerndigital my_cloud_mirror_g2_firmware5.25.132 or later
- westerndigital my_cloud_dl2100_firmware5.25.132 or later
- westerndigital my_cloud_dl4100_firmware5.25.132 or later
- westerndigital my_cloud_ex2100_firmware5.25.132 or later
- westerndigital my_cloud_home_firmware8.13.1-102 or later
- westerndigital my_cloud_home_duo_firmware8.13.1-102 or later
- westerndigital my_cloud_firmware5.25.132 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| westerndigital sandisk_ibi_firmware | v < 8.13.1-102 | 8.13.1-102 |
| westerndigital my_cloud_pr2100_firmware | v < 5.25.132 | 5.25.132 |
| westerndigital my_cloud_pr4100_firmware | v < 5.25.132 | 5.25.132 |
| westerndigital my_cloud_ex4100_firmware | v < 5.25.132 | 5.25.132 |
| westerndigital my_cloud_ex2_ultra_firmware | v < 5.25.132 | 5.25.132 |
| westerndigital my_cloud_mirror_g2_firmware | v < 5.25.132 | 5.25.132 |
| westerndigital my_cloud_dl2100_firmware | v < 5.25.132 | 5.25.132 |
| westerndigital my_cloud_dl4100_firmware | v < 5.25.132 | 5.25.132 |
| westerndigital my_cloud_ex2100_firmware | v < 5.25.132 | 5.25.132 |
| westerndigital my_cloud_home_firmware | v < 8.13.1-102 | 8.13.1-102 |
| westerndigital my_cloud_home_duo_firmware | v < 8.13.1-102 | 8.13.1-102 |
| westerndigital my_cloud_firmware | v < 5.25.132 | 5.25.132 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.