PT-2023-13475 · Sandisk+1 · Sandisk Ibi+2

Noam Moshe + 3 · Published 2023-05-18 · Updated 2023-06-19 · CVE-2022-36328

Positive Technologies (AI Summary)

CVSS v3.1

5.8

Medium

Base vector

AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Western Digital My Cloud Home versions prior to 9.4.0-191 Western Digital My Cloud Home Duo versions prior to 9.4.0-191 SanDisk ibi versions prior to 9.4.0-191 Western Digital My Cloud OS 5 versions prior to 5.26.202

Description A Path Traversal vulnerability was discovered in Western Digital My Cloud Home, My Cloud Home Duo, SanDisk ibi, and Western Digital My Cloud OS 5 devices. This issue could allow an attacker to create arbitrary shares on arbitrary directories and exfiltrate sensitive files, passwords, users, and device configurations. The exploitation of this issue requires an attacker to gain root privileges on the devices using an authentication bypass issue or another vulnerability.

Recommendations For Western Digital My Cloud Home and My Cloud Home Duo versions prior to 9.4.0-191, update to version 9.4.0-191 or later. For SanDisk ibi versions prior to 9.4.0-191, update to version 9.4.0-191 or later. For Western Digital My Cloud OS 5 versions prior to 5.26.202, update to version 5.26.202 or later. As a temporary workaround, consider restricting access to sensitive files and directories until a patch is available.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2022-36328

ZDI-23-848

Affected Products

Sandisk Ibi

Western Digital My Cloud Home

Western Digital My Cloud Os 5

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2022-36328 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-23-848 · Security Note
• https://osv.dev/vulnerability/CVE-2022-36328 · Vendor Advisory
• https://westerndigital.com/support/product-security/wdc-23006-my-cloud-firmware-version-5-26-202 · Vendor Advisory
• https://westerndigital.com/support/product-security/wdc-23003-western-digital-my-cloud-home-my-cloud-home-duo-and-sandisk-ibi-firmware-version-9-4-0-191 · Vendor Advisory
• https://t.me/cibsecurity/64427 · Telegram Post
• https://t.me/cvenotify/50766 · Telegram Post
• https://t.me/true_secator/4517 · Telegram Post
• https://t.me/cvenotify/50762 · Telegram Post