Skip to content
OpenAdvisories
Critical · 10.0 CVE-2022-36331 EUVD-2022-39047GHSA-q3w5-whrj-66qg

Impersonation attack causing an Authentication Bypass on Western Digital devices

Published Jun 12, 2023 · Updated Jan 3, 2025 · Assigned by WDC PSIRT

Vendor: SanDisk Vendor: Western Digital Product: ibi Product: My Cloud Home and My Cloud Home Duo Product: My Cloud OS 5

Description

Western Digital My Cloud, My Cloud Home, My Cloud Home Duo, and SanDisk ibi devices were vulnerable to an impersonation attack that could allow an unauthenticated attacker to gain access to user data.
This issue affects My Cloud OS 5 devices: before 5.25.132; My Cloud Home and My Cloud Home Duo: before 8.13.1-102; SanDisk ibi: before 8.13.1-102.

Affected products

VendorProductAffectedFixed
Western Digital My Cloud OS 5 < 5.25.132 5.25.132
Western Digital My Cloud Home and My Cloud Home Duo < 8.13.1-102 8.13.1-102
SanDisk ibi < 8.13.1-102 8.13.1-102

References