PT-2022-19867 · Western Digital · Western Digital My Cloud Home+1

Published 2022-12-01 · Updated 2022-12-06 · CVE-2022-29837

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Western Digital My Cloud Home (affected versions not specified) Western Digital My Cloud Home Duo (affected versions not specified) SanDisk ibi (affected versions not specified)

Description A path traversal issue was addressed in the mentioned devices, which could allow an attacker to initiate installation of custom ZIP packages and overwrite system files, potentially leading to code execution.

Recommendations For Western Digital My Cloud Home, update to a version that includes the fix for this issue. For Western Digital My Cloud Home Duo, update to a version that includes the fix for this issue. For SanDisk ibi, update to a version that includes the fix for this issue. As a temporary workaround, consider restricting access to the ZIP package installation feature until a patch is available.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2022-29837

Affected Products

Sandisk Ibi

Western Digital My Cloud Home

References · 4

• https://osv.dev/vulnerability/CVE-2022-29837 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-29837 · Security Note
• https://westerndigital.com/support/product-security/wdc-22018-western-digital-my-cloud-home-my-cloud-home-duo-and-sandisk-ibi-firmware-version-8-12-0-178 · Vendor Advisory
• https://t.me/cibsecurity/53772 · Telegram Post