PT-2022-15774 · Western Digital+1 · Western Digital My Cloud Home+1

Published 2022-09-27 · Updated 2022-10-03 · CVE-2022-23006

Positive Technologies (AI Summary)

CVSS v3.1

6.7

Medium

Base vector

AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Western Digital My Cloud Home (affected versions not specified) Western Digital My Cloud Home Duo (affected versions not specified) SanDisk ibi (affected versions not specified)

Description A stack-based buffer overflow issue was found that could allow an attacker with local system access to read information from the /etc/version file. This issue can only be exploited by combining it with another problem. If an attacker can carry out a remote code execution attack, they can access the vulnerable file due to insecure functions in the code. User interaction is required for exploitation. Exploiting this issue could result in information exposure, file modification, memory access errors, or system crashes.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Memory Corruption

Stack Overflow

Weakness Enumeration

CWE-787

CWE-121

Related Identifiers

CVE-2022-23006

Affected Products

Sandisk Ibi

Western Digital My Cloud Home

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2022-23006 · Security Note
• https://osv.dev/vulnerability/CVE-2022-23006 · Vendor Advisory
• https://westerndigital.com/support/product-security/wdc-22015-western-digital-my-cloud-home-and-sandisk-ibi-firmware-version-8-10-0-117 · Vendor Advisory
• https://t.me/cibsecurity/50553 · Telegram Post