Vulnerability · Published Jun 12, 2023 · Assigned by WDC PSIRT
CVE-2022-36331Impersonation attack causing an Authentication Bypass on Western Digital devices
Critical 10.0
In plain English
A critical-severity authentication bypass by spoofing in ibi from SanDisk. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 48% of all known vulnerabilities).
Official description
Western Digital My Cloud, My Cloud Home, My Cloud Home Duo, and SanDisk ibi devices were vulnerable to an impersonation attack that could allow an unauthenticated attacker to gain access to user data. This issue affects My Cloud OS 5 devices: before 5.25.132; My Cloud Home and My Cloud Home Duo: before 8.13.1-102; SanDisk ibi: before 8.13.1-102.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Western Digital | My Cloud OS 5 | 0 – before 5.25.132 |
| Western Digital | My Cloud Home and My Cloud Home Duo | 0 – before 8.13.1-102 |
| SanDisk | ibi | 0 – before 8.13.1-102 |
Weakness: CWE-290 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H