by Kastro
Paper/Archive/CVE-2022-36331

CVE-2022-36331

Western Digital My Cloud OS 5 — Impersonation attack causing an Authentication Bypass on Western Digital devices

EPSS 0.6%CVSS 10.0
critical.is priorityof 100
40
CVSS 10.0 (CNA)10.0 / 10 × 3030.0Not in CISA KEV+300.0EPSS percentile 48.3.483 × 209.7No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Western Digital My Cloud, My Cloud Home, My Cloud Home Duo, and SanDisk ibi devices were vulnerable to an impersonation attack that could allow an unauthenticated attacker to gain access to user data. This issue affects My Cloud OS 5 devices: before 5.25.132; My Cloud Home and My Cloud Home Duo: before 8.13.1-102; SanDisk ibi: before 8.13.1-102.

Affected

ProductAffectedFixed inSource
My Cloud OS 5< 5.25.1325.25.132CNA
My Cloud Home and My Cloud Home Duo< 8.13.1-102 8.13.1-102CNA
ibi< 8.13.1-102 8.13.1-102CNA

Scores by source

WDC PSIRT (CNA)10.0CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: partial

References

refhttps://www.westerndigital.com/support/product-security/wdc-22020-my-cloud-os-5-my-cloud-home-ibi-firmware-update