PT-2023-3181 · Sandisk+1 · Sandisk Ibi+2

Noam Moshe + 3 · Published 2023-02-08 · Updated 2023-06-19 · CVE-2022-36327

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Western Digital My Cloud Home versions prior to 9.4.0-191 Western Digital My Cloud Home Duo versions prior to 9.4.0-191 SanDisk ibi versions prior to 9.4.0-191 Western Digital My Cloud OS 5 versions prior to 5.26.202

Description A Path Traversal vulnerability could allow an attacker to write files to locations with certain critical filesystem types, leading to remote code execution. This issue requires an authentication bypass issue to be triggered before it can be exploited.

Recommendations For Western Digital My Cloud Home versions prior to 9.4.0-191, update to version 9.4.0-191 or later. For Western Digital My Cloud Home Duo versions prior to 9.4.0-191, update to version 9.4.0-191 or later. For SanDisk ibi versions prior to 9.4.0-191, update to version 9.4.0-191 or later. For Western Digital My Cloud OS 5 versions prior to 5.26.202, update to version 5.26.202 or later.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

BDU:2023-03290

CVE-2022-36327

Affected Products

Sandisk Ibi

Western Digital My Cloud Home

Western Digital My Cloud Os 5

References · 9

• https://osv.dev/vulnerability/CVE-2022-36327 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-36327 · Security Note
• https://westerndigital.com/support/product-security/wdc-23006-my-cloud-firmware-version-5-26-202 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-03290 · Security Note
• https://westerndigital.com/support/product-security/wdc-23003-western-digital-my-cloud-home-my-cloud-home-duo-and-sandisk-ibi-firmware-version-9-4-0-191 · Vendor Advisory
• https://t.me/cvenotify/50767 · Telegram Post
• https://t.me/true_secator/4517 · Telegram Post
• https://t.me/cibsecurity/64415 · Telegram Post
• https://t.me/cvenotify/50763 · Telegram Post