PT-2023-2419 · Western Digital · Western Digital My Cloud

Published 2023-01-10 · Updated 2023-04-24 · CVE-2022-29844

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Western Digital My Cloud OS versions prior to 5.26.119

Description The issue is related to the FTP service, where an incorrect restriction of a directory path name with limited access allows an attacker to read and write arbitrary files. This could lead to a full NAS compromise, giving the attacker remote execution capabilities. The vulnerability is associated with the FTP service of Western Digital My Cloud OS, where exploitation can allow a remote attacker to gain full access to the device and execute arbitrary code.

Recommendations For versions prior to 5.26.119, update the firmware to version 5.26.119 or later to resolve the issue. As a temporary workaround, consider disabling the FTP service until a patch is available. Restrict access to the FTP server to minimize the risk of exploitation.

Fix

Relative Path Traversal

Path traversal

Weakness Enumeration

CWE-23

CWE-22

Related Identifiers

BDU:2023-02204

CVE-2022-29844

ZDI-23-112

Affected Products

Western Digital My Cloud

References · 9

• https://osv.dev/vulnerability/CVE-2022-29844 · Vendor Advisory
• https://zerodayinitiative.com/advisories/ZDI-23-112 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-29844 · Security Note
• https://westerndigital.com/en-in/support/product-security/wdc-23002-my-cloud-firmware-version-5-26-119 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-02204 · Security Note
• https://t.me/cybersecuritytechnologies/8177 · Telegram Post
• https://t.me/pentestingnews/35226 · Telegram Post
• https://t.me/ckure/12349 · Telegram Post
• https://t.me/pentestingnews/35334 · Telegram Post