7.5

CVE-2022-36331

Impersonation attack causing an Authentication Bypass on Western Digital devices

Western Digital My Cloud, My Cloud Home, My Cloud Home Duo, and SanDisk ibi devices were vulnerable to an impersonation attack that could allow an unauthenticated attacker to gain access to user data.
This issue affects My Cloud OS 5 devices: before 5.25.132; My Cloud Home and My Cloud Home Duo: before 8.13.1-102; SanDisk ibi: before 8.13.1-102.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Westerndigital ≫ My Cloud Pr2100 Firmware Version < 5.25.132
   Westerndigital ≫ My Cloud Pr2100 Version -
Westerndigital ≫ My Cloud Pr4100 Firmware Version < 5.25.132
   Westerndigital ≫ My Cloud Pr4100 Version -
Westerndigital ≫ My Cloud Ex4100 Firmware Version < 5.25.132
   Westerndigital ≫ My Cloud Ex4100 Version -
Westerndigital ≫ My Cloud Dl2100 Firmware Version < 5.25.132
   Westerndigital ≫ My Cloud Dl2100 Version -
Westerndigital ≫ My Cloud Dl4100 Firmware Version < 5.25.132
   Westerndigital ≫ My Cloud Dl4100 Version -
Westerndigital ≫ My Cloud Ex2100 Firmware Version < 5.25.132
   Westerndigital ≫ My Cloud Ex2100 Version -
Westerndigital ≫ My Cloud Home Firmware Version < 8.13.1-102
   Westerndigital ≫ My Cloud Home Version -
Westerndigital ≫ My Cloud Home Duo Firmware Version < 8.13.1-102
   Westerndigital ≫ My Cloud Home Duo Version -
Westerndigital ≫ Sandisk Ibi Firmware Version < 8.13.1-102
   Westerndigital ≫ Sandisk Ibi Version -
Westerndigital ≫ My Cloud Firmware Version < 5.25.132
   Westerndigital ≫ My Cloud Version -
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.59% 0.436
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 7.5 3.9 3.6
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
psirt@wdc.com 10 3.9 6
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CWE-290 Authentication Bypass by Spoofing

This attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks.

https://https://www.westerndigital.com/support/product-security/wdc-22020-my-cloud-os-5-my-cloud-home-ibi-firmware-update
Broken Link
https://www.westerndigital.com/support/product-security/wdc-22020-my-cloud-os-5-my-cloud-home-ibi-firmware-update
Vendor Advisory