PT-2022-19866 · Western Digital+1 · Western Digital My Cloud Home+1

Published 2022-11-09 · Updated 2022-11-15 · CVE-2022-29836

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Western Digital My Cloud Home versions prior to 8.11.0-113 Western Digital My Cloud Home Duo versions prior to 8.11.0-113 SanDisk ibi versions prior to 8.11.0-113

Description A Path Traversal vulnerability was discovered via an HTTP API on Western Digital My Cloud Home, My Cloud Home Duo, and SanDisk ibi devices. This issue could allow an attacker to abuse certain parameters to point to random locations on the file system, potentially initiating the installation of custom packages at these locations. The attacker must be authenticated to the device to exploit this issue.

Recommendations For Western Digital My Cloud Home versions prior to 8.11.0-113, update to version 8.11.0-113 or later to resolve the issue. For Western Digital My Cloud Home Duo versions prior to 8.11.0-113, update to version 8.11.0-113 or later to resolve the issue. For SanDisk ibi versions prior to 8.11.0-113, update to version 8.11.0-113 or later to resolve the issue. As a temporary workaround, consider restricting access to the HTTP API until a patch is available.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2022-29836

Affected Products

Sandisk Ibi

Western Digital My Cloud Home

References · 4

• https://westerndigital.com/support/product-security/wdc-22016-my-cloud-home-ibi-firmware-version-8-11-0-113 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-29836 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-29836 · Security Note
• https://t.me/cvenotify/37562 · Telegram Post