Vulnerability Description
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could allow an attacker to write files to locations with certain critical filesystem types leading to remote code execution was discovered in Western Digital My Cloud Home, My Cloud Home Duo, SanDisk ibi and Western Digital My Cloud OS 5 devices. This issue requires an authentication bypass issue to be triggered before this can be exploited. This issue affects My Cloud Home and My Cloud Home Duo: before 9.4.0-191; ibi: before 9.4.0-191; My Cloud OS 5: before 5.26.202.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Westerndigital | My Cloud Os 5 | < 5.26.202 |
| Westerndigital | My Cloud | - |
| Westerndigital | My Cloud Dl2100 | - |
| Westerndigital | My Cloud Dl4100 | - |
| Westerndigital | My Cloud Ex2 Ultra | - |
| Westerndigital | My Cloud Ex2100 | - |
| Westerndigital | My Cloud Ex4100 | - |
| Westerndigital | My Cloud Mirror G2 | - |
| Westerndigital | My Cloud Pr2100 | - |
| Westerndigital | My Cloud Pr4100 | - |
| Westerndigital | Wd Cloud | - |
| Westerndigital | My Cloud Home Firmware | < 9.4.0-191 |
| Westerndigital | My Cloud Home | - |
| Westerndigital | Sandisk Ibi Firmware | < 9.4.0-191 |
| Westerndigital | Sandisk Ibi | - |
| Westerndigital | My Cloud Home Duo Firmware | < 9.4.0-191 |
| Westerndigital | My Cloud Home Duo | - |
Related Weaknesses (CWE)
References
- https://www.westerndigital.com/support/product-security/wdc-23003-western-digitaRelease NotesVendor Advisory
- https://www.westerndigital.com/support/product-security/wdc-23006-my-cloud-firmwRelease NotesVendor Advisory
- https://www.westerndigital.com/support/product-security/wdc-23003-western-digitaRelease NotesVendor Advisory
- https://www.westerndigital.com/support/product-security/wdc-23006-my-cloud-firmwRelease NotesVendor Advisory
FAQ
What is CVE-2022-36327?
CVE-2022-36327 is a vulnerability with a CVSS score of 5.8 (MEDIUM). Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could allow an attacker to write files to locations with certain critical filesystem types leading to ...
How severe is CVE-2022-36327?
CVE-2022-36327 has been rated MEDIUM with a CVSS base score of 5.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2022-36327?
Check the references section above for vendor advisories and patch information. Affected products include: Westerndigital My Cloud Os 5, Westerndigital My Cloud, Westerndigital My Cloud Dl2100, Westerndigital My Cloud Dl4100, Westerndigital My Cloud Ex2 Ultra.