Lucene search

WDC PSIRTCVE-2022-29837

HistoryDec 01, 2022 - 5:15 p.m.

CVE-2022-29837

2022-12-0117:15:11

CWE-22

WDC PSIRT

web.nvd.nist.gov

cve-2022-29837

path traversal

vulnerability

western-digital

my cloud home

my cloud home duo

sandisk

ibi

zip

code execution

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

7.6

Confidence

High

EPSS

Percentile

10.0%

JSON

A path traversal vulnerability was addressed in Western Digital My Cloud Home, My Cloud Home Duo and SanDisk ibi which could allow an attacker to initiate installation of custom ZIP packages and overwrite system files. This could potentially lead to a code execution.

Affected configurations

Nvd

Node

westerndigitalmy_cloud_homeMatch-

AND

westerndigitalmy_cloud_home_firmwareRange<8.12.0-178

Node

westerndigitalmy_cloud_home_duoMatch-

AND

westerndigitalmy_cloud_home_duo_firmwareRange<8.12.0-178

Node

westerndigitalsandisk_ibiMatch-

AND

westerndigitalsandisk_ibi_firmwareRange<8.12.0-178

VendorProductVersionCPE
westerndigitalmy_cloud_home-cpe:2.3:h:westerndigital:my_cloud_home:-:*:*:*:*:*:*:*
westerndigitalmy_cloud_home_firmware*cpe:2.3:o:westerndigital:my_cloud_home_firmware:*:*:*:*:*:*:*:*
westerndigitalmy_cloud_home_duo-cpe:2.3:h:westerndigital:my_cloud_home_duo:-:*:*:*:*:*:*:*
westerndigitalmy_cloud_home_duo_firmware*cpe:2.3:o:westerndigital:my_cloud_home_duo_firmware:*:*:*:*:*:*:*:*
westerndigitalsandisk_ibi-cpe:2.3:h:westerndigital:sandisk_ibi:-:*:*:*:*:*:*:*
westerndigitalsandisk_ibi_firmware*cpe:2.3:o:westerndigital:sandisk_ibi_firmware:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
westerndigital	my_cloud_home	-	cpe:2.3:h:westerndigital:my_cloud_home:-:::::::*
westerndigital	my_cloud_home_firmware	*	cpe:2.3:o:westerndigital:my_cloud_home_firmware::::::::
westerndigital	my_cloud_home_duo	-	cpe:2.3:h:westerndigital:my_cloud_home_duo:-:::::::*
westerndigital	my_cloud_home_duo_firmware	*	cpe:2.3:o:westerndigital:my_cloud_home_duo_firmware::::::::
westerndigital	sandisk_ibi	-	cpe:2.3:h:westerndigital:sandisk_ibi:-:::::::*
westerndigital	sandisk_ibi_firmware	*	cpe:2.3:o:westerndigital:sandisk_ibi_firmware::::::::

CNA Affected

[
  {
    "vendor": "Western Digital",
    "product": "My Cloud Home",
    "versions": [
      {
        "version": "My Cloud Home ",
        "status": "affected",
        "lessThan": "8.12.0-178",
        "versionType": "custom"
      },
      {
        "version": "My Cloud Home Duo",
        "status": "affected",
        "lessThan": "8.12.0-178",
        "versionType": "custom"
      }
    ],
    "platforms": [
      "Linux"
    ]
  },
  {
    "vendor": "SanDisk",
    "product": "ibi",
    "versions": [
      {
        "version": "ibi",
        "status": "affected",
        "lessThan": "8.12.0-178",
        "versionType": "custom"
      }
    ],
    "platforms": [
      "Linux"
    ]
  }
]

References

www.westerndigital.com/support/product-security/wdc-22018-western-digital-my-cloud-home-my-cloud-home-duo-and-sandisk-ibi-firmware-version-8-12-0-178

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

7.6

Confidence

High

EPSS

Percentile

10.0%

JSON

Related for CVE-2022-29837