by Kastro
Paper/Archive/CVE-2024-22170

CVE-2024-22170

Western Digital My Cloud — Unchecked buffer in Dynamic DNS client

EPSS 0.5%CVSS 9.2
critical.is priorityof 100
36
CVSS 9.2 (CNA)9.2 / 10 × 3027.6Not in CISA KEV+300.0EPSS percentile 40.5.405 × 208.1No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in Western Digital My Cloud ddns-start on Linux allows Overflow Buffers.This issue affects My Cloud: before 5.29.102.

Affected

ProductAffectedFixed inSource
My Cloud< 5.29.1025.29.102CNA
wd_cloud_firmware< 5.29.1025.29.102CISA-ADP
my_cloud_dl4100_firmware< 5.29.1025.29.102CISA-ADP
my_cloud_dl2100_firmware< 5.29.1025.29.102CISA-ADP
my_cloud_ex2100_firmware< 5.29.1025.29.102CISA-ADP
my_cloud_mirror_g2_firmware< 5.29.1025.29.102CISA-ADP
my_cloud_firmware< 5.29.1025.29.102CISA-ADP
my_cloud_pr4100_firmware< 5.29.1025.29.102CISA-ADP
my_cloud_pr2100_firmware< 5.29.1025.29.102CISA-ADP
my_cloud_ex4100_firmware< 5.29.1025.29.102CISA-ADP
my_cloud_ex2_ultra_firmware< 5.29.1025.29.102CISA-ADP

Scores by source

WDC PSIRT (CNA)9.2CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

advisorywesterndigital.com/support/product-security/wdc-24005-western-digital-my-cloud-os-5-firmware-5-29-102