CVE-2022-29842 Command Injection Vulnerability in Western Digital My Cloud devices

Improper Neutralization of Special Elements used in a Command 'Command Injection' vulnerability that could allow an attacker to execute code in the context of the root user on a vulnerable CGI file was discovered in Western Digital My Cloud OS 5 devicesThis issue affects My Cloud OS 5: before...

CVE-2022-29842

CVE-2022-29842 affects Western Digital My Cloud OS 5 devices, prior to version 5.26.119. The issue is a Command Injection vulnerability in the CGI file (account_mgr) that can allow an attacker to execute code in the root context. Some sources describe this as remote code execution with network ac...

CVE-2022-29842 Command Injection Vulnerability in Western Digital My Cloud devices

Improper Neutralization of Special Elements used in a Command 'Command Injection' vulnerability that could allow an attacker to execute code in the context of the root user on a vulnerable CGI file was discovered in Western Digital My Cloud OS 5 devicesThis issue affects My Cloud OS 5: before...

CVE-2022-36329

An improper privilege management issue that could allow an attacker to cause a denial of service over the OTA mechanism was discovered in Western Digital My Cloud Home, My Cloud Home Duo and SanDisk ibi devices.This issue affects My Cloud Home and My Cloud Home Duo: before 9.4.0-191; ibi: before...

CVE-2022-36329

An improper privilege management issue that could allow an attacker to cause a denial of service over the OTA mechanism was discovered in Western Digital My Cloud Home, My Cloud Home Duo and SanDisk ibi devices.This issue affects My Cloud Home and My Cloud Home Duo: before 9.4.0-191; ibi: before...

Input validation

An improper privilege management issue that could allow an attacker to cause a denial of service over the OTA mechanism was discovered in Western Digital My Cloud Home, My Cloud Home Duo and SanDisk ibi devices.This issue affects My Cloud Home and My Cloud Home Duo: before 9.4.0-191; ibi: before...

CVE-2022-36329 Denial of Service over OTA mechanism in Western Digital My Cloud Home and ibi devices

An improper privilege management issue that could allow an attacker to cause a denial of service over the OTA mechanism was discovered in Western Digital My Cloud Home, My Cloud Home Duo and SanDisk ibi devices.This issue affects My Cloud Home and My Cloud Home Duo: before 9.4.0-191; ibi: before...

CVE-2022-36329

The CVE-2022-36329 issue affects Western Digital My Cloud Home, My Cloud Home Duo, and SanDisk ibi devices. The root cause is improper privilege management that can allow an attacker to cause a denial of service over the OTA mechanism. Affected versions are before 9.4.0-191 for My Cloud Home and ...

CVE-2022-36329 Denial of Service over OTA mechanism in Western Digital My Cloud Home and ibi devices

An improper privilege management issue that could allow an attacker to cause a denial of service over the OTA mechanism was discovered in Western Digital My Cloud Home, My Cloud Home Duo and SanDisk ibi devices.This issue affects My Cloud Home and My Cloud Home Duo: before 9.4.0-191; ibi: before...

The Velociraptor 2023 Annual Community Survey

By Dr. Mike Cohen & Carlos Canto Velociraptor is an open-source project led and shaped by the community. Over the years, Velociraptor has become a real force in the field of DFIR, making it an obvious choice for many operational situations. Rapid7 is committed to continue making Velociraptor the...

[SECURITY] Fedora 38 Update: LibRaw-0.21.1-4.fc38

LibRaw is a library for reading RAW files obtained from digital photo cameras CRW/CR2, NEF, RAF, DNG, and others. LibRaw is based on the source codes of the dcraw utility, where part of drawbacks have already been eliminated and part will be fixed in future...

Buffer overflow

A buffer overflow vulnerability was discovered on firmware version validation that could lead to an unauthenticated remote code execution in Western Digital My Cloud Home, My Cloud Home Duo and SanDisk ibi devices. An attacker would require exploitation of another vulnerability to raise their...

Western Digital My Cloud 操作系统命令注入漏洞

Western Digital My Cloud is a personal cloud storage device from Western Digital. A security vulnerability exists in Western Digital My Cloud OS 5 prior to version 5.26.119, which stems from an operating system command injection vulnerability that can be exploited by an attacker to remotely execu...

Firmware and Intel Boot Guard keys leaked in ransomware attack on MSI

In late March, hardware manufacturer MSI was hit by a ransomware attack. As a result of this ransomware attack, private keys were according to security firm Binarly, private keys were leaked that are used to digitally sign firmware for motherboards. Also compromised were private keys used by Inte...

CVE-2022-36329: Uncontrolled Resource Consumption

An improper privilege management issue that could allow an attacker to cause a denial of service over the OTA mechanism was discovered in Western Digital My Cloud Home, My Cloud Home Duo and SanDisk ibi devices.This issue affects My Cloud Home and My Cloud Home Duo: before 9.4.0-191; ibi: before...

PT-2023-12987 · Western Digital · Western Digital My Cloud Os 5

Name of the Vulnerable Software and Affected Versions: Western Digital My Cloud OS 5 versions prior to 5.26.119 Description: An issue was discovered in Western Digital My Cloud OS 5 devices, allowing an attacker to execute code in the context of the root user on a vulnerable CGI file due to...

CVE-2022-29842: Improper Neutralization of Special Elements used in a Command

Improper Neutralization of Special Elements used in a Command 'Command Injection' vulnerability that could allow an attacker to execute code in the context of the root user on a vulnerable CGI file was discovered in Western Digital My Cloud OS 5 devicesThis issue affects My Cloud OS 5: before...

PT-2023-13476 · Sandisk +1 · Sandisk Ibi +1

Name of the Vulnerable Software and Affected Versions: Western Digital My Cloud Home versions prior to 9.4.0-191 Western Digital My Cloud Home Duo versions prior to 9.4.0-191 SanDisk ibi versions prior to 9.4.0-191 Description: An improper privilege management issue could allow an attacker to cau...

CVE-2022-29840: Server-Side Request Forgery (SSRF)

Server-Side Request Forgery SSRF vulnerability that could allow a rogue server on the local network to modify its URL to point back to the loopback adapter was addressed in Western Digital My Cloud OS 5 devices. This could allow the URL to exploit other vulnerabilities on the local server.This...

CVE-2022-29841: Improper Neutralization of Special Elements used in an OS Command

Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability that was caused by a command that read files from a privileged location and created a system command without sanitizing the read data. This command could be triggered by an attacker remotely to...