Lucene search

WDC PSIRTCVE-2022-36330

HistoryMay 10, 2023 - 12:15 a.m.

CVE-2022-36330

2023-05-1000:15:09

CWE-120

WDC PSIRT

web.nvd.nist.gov

cve-2022-36330

buffer overflow

firmware validation

remote code execution

western digital

my cloud home

my cloud home duo

sandisk ibi

security vulnerability

CVSS3

8.1

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

8.5

Confidence

High

EPSS

0.004

Percentile

73.7%

JSON

A buffer overflow vulnerability was discovered on firmware version validation that could lead to an unauthenticated remote code execution in Western Digital My Cloud Home, My Cloud Home Duo and SanDisk ibi devices. An attacker would require exploitation of another vulnerability to raise their privileges in order to exploit this buffer overflow vulnerability.

This issue affects My Cloud Home and My Cloud Home Duo: before 9.4.0-191; ibi: before 9.4.0-191.

Affected configurations

Nvd

Node

westerndigitalmy_cloud_home_duoMatch-

AND

westerndigitalmy_cloud_home_duo_firmwareRange<9.4.0-191

Node

westerndigitalmy_cloud_home_duoMatch-

AND

westerndigitalmy_cloud_home_duo_firmwareRange<9.4.0-191

Node

westerndigitalsandisk_ibiMatch-

AND

westerndigitalsandisk_ibi_firmwareRange<9.4.0-191

Node

westerndigitalmy_cloud_home_firmwareRange<9.4.0-191

AND

westerndigitalmy_cloud_homeMatch-

VendorProductVersionCPE
westerndigitalmy_cloud_home_duo-cpe:2.3:h:westerndigital:my_cloud_home_duo:-:*:*:*:*:*:*:*
westerndigitalmy_cloud_home_duo_firmware*cpe:2.3:o:westerndigital:my_cloud_home_duo_firmware:*:*:*:*:*:*:*:*
westerndigitalsandisk_ibi-cpe:2.3:h:westerndigital:sandisk_ibi:-:*:*:*:*:*:*:*
westerndigitalsandisk_ibi_firmware*cpe:2.3:o:westerndigital:sandisk_ibi_firmware:*:*:*:*:*:*:*:*
westerndigitalmy_cloud_home_firmware*cpe:2.3:o:westerndigital:my_cloud_home_firmware:*:*:*:*:*:*:*:*
westerndigitalmy_cloud_home-cpe:2.3:h:westerndigital:my_cloud_home:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
westerndigital	my_cloud_home_duo	-	cpe:2.3:h:westerndigital:my_cloud_home_duo:-:::::::*
westerndigital	my_cloud_home_duo_firmware	*	cpe:2.3:o:westerndigital:my_cloud_home_duo_firmware::::::::
westerndigital	sandisk_ibi	-	cpe:2.3:h:westerndigital:sandisk_ibi:-:::::::*
westerndigital	sandisk_ibi_firmware	*	cpe:2.3:o:westerndigital:sandisk_ibi_firmware::::::::
westerndigital	my_cloud_home_firmware	*	cpe:2.3:o:westerndigital:my_cloud_home_firmware::::::::
westerndigital	my_cloud_home	-	cpe:2.3:h:westerndigital:my_cloud_home:-:::::::*

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "platforms": [
      "Linux"
    ],
    "product": "My Cloud Home and My Cloud Home Duo",
    "vendor": "Western Digital",
    "versions": [
      {
        "lessThan": " 9.4.0-191",
        "status": "affected",
        "version": "0",
        "versionType": "custom"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "platforms": [
      "Linux"
    ],
    "product": "ibi",
    "vendor": "SanDisk",
    "versions": [
      {
        "lessThan": " 9.4.0-191",
        "status": "affected",
        "version": "0",
        "versionType": "custom"
      }
    ]
  }
]

References

www.westerndigital.com/support/product-security/wdc-23003-western-digital-my-cloud-home-my-cloud-home-duo-and-sandisk-ibi-firmware-version-9-4-0-191

CVSS3

8.1

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

8.5

Confidence

High

EPSS

0.004

Percentile

73.7%

JSON

Related for CVE-2022-36330