PT-2023-3277 · Sandisk +1 · Sandisk Ibi +3

Name of the Vulnerable Software and Affected Versions: Western Digital My Cloud versions prior to 5.25.132 My Cloud Home and My Cloud Home Duo versions prior to 8.13.1-102 SanDisk ibi versions prior to 8.13.1-102 Description: The issue is related to an impersonation attack that could allow an...

PT-2023-3181 · Western Digital +1 · Western Digital My Cloud Os 5 +2

Name of the Vulnerable Software and Affected Versions: Western Digital My Cloud Home versions prior to 9.4.0-191 Western Digital My Cloud Home Duo versions prior to 9.4.0-191 SanDisk ibi versions prior to 9.4.0-191 Western Digital My Cloud OS 5 versions prior to 5.26.202 Description: A Path...

CVE-2021-36226

Western Digital My Cloud devices before OS5 do not use cryptographically signed Firmware upgrade files...

CVE-2021-36224

Western Digital My Cloud devices before OS5 have a nobody account with a blank password...

CVE-2021-36226

Western Digital My Cloud devices before OS5 do not use cryptographically signed Firmware upgrade files...

CVE-2021-36225

Western Digital My Cloud devices before OS5 allow REST API access by low-privileged accounts, as demonstrated by API commands for firmware uploads and installation...

CVE-2021-36224

Western Digital My Cloud devices before OS5 have a nobody account with a blank password...

Information disclosure

Western Digital My Cloud devices before OS5 allow REST API access by low-privileged accounts, as demonstrated by API commands for firmware uploads and installation...

Code injection

Western Digital My Cloud devices before OS5 do not use cryptographically signed Firmware upgrade files...

CVE-2021-36226

Western Digital My Cloud devices prior to OS5 are vulnerable due to firmware upgrade files not being cryptographically signed. The root cause is the lack of signature verification for firmware updates, enabling potential tampering with updates and impacting integrity and availability. Reported as...

CVE-2021-36226

Western Digital My Cloud devices before OS5 do not use cryptographically signed Firmware upgrade files...

CVE-2021-36225

CVE-2021-36225 affects Western Digital My Cloud devices prior to OS5. The vulnerability allows REST API access by low-privileged accounts, demonstrated by commands for firmware uploads and installation. Documented CVSS: 3.1 base score 8.8 (High) with network attack vector, low complexity, require...

CVE-2021-36225

Western Digital My Cloud devices before OS5 allow REST API access by low-privileged accounts, as demonstrated by API commands for firmware uploads and installation...

CVE-2021-36224

Western Digital My Cloud devices before OS5 have a nobody account with a blank password...

CVE-2021-36224

CVE-2021-36224 affects Western Digital My Cloud devices prior to OS5, where a nobody account exists with a blank password. This enables unauthorized access over the network with no user interaction and no privileges required, leading to high confidentiality, integrity, and availability impact per...

CVE-2021-36226

Western Digital My Cloud devices before OS5 do not use cryptographically signed Firmware upgrade files...

PT-2023-12266 · Western Digital · Western Digital My Cloud

Name of the Vulnerable Software and Affected Versions: Western Digital My Cloud devices before OS5 Description: The issue concerns a nobody account with a blank password in Western Digital My Cloud devices. Recommendations: For Western Digital My Cloud devices before OS5, consider changing the...

CVE-2022-29844

A vulnerability in the FTP service of Western Digital My Cloud OS 5 devices running firmware versions prior to 5.26.119 allows an attacker to read and write arbitrary files. This could lead to a full NAS compromise and would give remote execution capabilities to the attacker...

CVE-2022-29843

A command injection vulnerability in the DDNS service configuration of Western Digital My Cloud OS 5 devices running firmware versions prior to 5.26.119 allows an attacker to execute code in the context of the root user...

CVE-2022-29843

A command injection vulnerability in the DDNS service configuration of Western Digital My Cloud OS 5 devices running firmware versions prior to 5.26.119 allows an attacker to execute code in the context of the root user...