Impersonation attack causing an Authentication Bypass on Western Digital devices
CVE-2022-36331

10CRITICAL

Key Information:

Vendor

Western Digital

Status
My Cloud Os 5
My Cloud Home And My Cloud Home Duo
Ibi
Vendor
CVE Published:
12 June 2023

What is CVE-2022-36331?

Certain Western Digital My Cloud products are vulnerable to an impersonation attack, allowing unauthenticated attackers to potentially access sensitive user data. This affects My Cloud OS 5 devices prior to version 5.25.132 and both My Cloud Home and My Cloud Home Duo devices as well as SanDisk ibi models before version 8.13.1-102. Users are encouraged to update their firmware to mitigate risks associated with unauthorized data access.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

ibi Linux 0

My Cloud Home and My Cloud Home Duo Linux 0

My Cloud OS 5 Linux 0 < 5.25.132

References

https://https://www.westerndigital.com/support/product-se...

CVSS V3.1

Score:
10
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Claroty Research, Team82 – Vera Mens, Noam Moshe, Uri Katz and Sharon Brizinov working with Trend Micro’s Zero Day Initiative
JSON
.