Vulnerability Description
An uncontrolled resource consumption vulnerability issue that could arise by sending crafted requests to a service to consume a large amount of memory, eventually resulting in the service being stopped and restarted was discovered in Western Digital My Cloud Home, My Cloud Home Duo, SanDisk ibi and Western Digital My Cloud OS 5 devices. This issue requires the attacker to already have root privileges in order to exploit this vulnerability.This issue affects My Cloud Home and My Cloud Home Duo: before 9.4.0-191; ibi: before 9.4.0-191; My Cloud OS 5: before 5.26.202.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Westerndigital | My Cloud Os 5 | < 5.26.202 |
| Westerndigital | My Cloud | - |
| Westerndigital | My Cloud Dl2100 | - |
| Westerndigital | My Cloud Dl4100 | - |
| Westerndigital | My Cloud Ex2 Ultra | - |
| Westerndigital | My Cloud Ex2100 | - |
| Westerndigital | My Cloud Ex4100 | - |
| Westerndigital | My Cloud Mirror G2 | - |
| Westerndigital | My Cloud Pr2100 | - |
| Westerndigital | My Cloud Pr4100 | - |
| Westerndigital | Wd Cloud | - |
| Westerndigital | My Cloud Home Firmware | < 9.4.0-191 |
| Westerndigital | My Cloud Home | - |
| Westerndigital | Sandisk Ibi Firmware | < 9.4.0-191 |
| Westerndigital | Sandisk Ibi | - |
| Westerndigital | My Cloud Home Duo Firmware | < 9.4.0-191 |
| Westerndigital | My Cloud Home Duo | - |
Related Weaknesses (CWE)
References
- https://www.westerndigital.com/support/product-security/wdc-23003-western-digitaRelease NotesVendor Advisory
- https://www.westerndigital.com/support/product-security/wdc-23006-my-cloud-firmwRelease NotesVendor Advisory
- https://www.westerndigital.com/support/product-security/wdc-23003-western-digitaRelease NotesVendor Advisory
- https://www.westerndigital.com/support/product-security/wdc-23006-my-cloud-firmwRelease NotesVendor Advisory
FAQ
What is CVE-2022-36326?
CVE-2022-36326 is a vulnerability with a CVSS score of 4.4 (MEDIUM). An uncontrolled resource consumption vulnerability issue that could arise by sending crafted requests to a service to consume a large amount of memory, eventually resulting in the service being stoppe...
How severe is CVE-2022-36326?
CVE-2022-36326 has been rated MEDIUM with a CVSS base score of 4.4/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2022-36326?
Check the references section above for vendor advisories and patch information. Affected products include: Westerndigital My Cloud Os 5, Westerndigital My Cloud, Westerndigital My Cloud Dl2100, Westerndigital My Cloud Dl4100, Westerndigital My Cloud Ex2 Ultra.