Multiple vulnerabilities in Western Digital My Cloud OS 5



Published: 2022-12-06
Risk Medium
Patch available YES
Number of vulnerabilities 18
CVE-ID CVE-2022-27776
CVE-2022-29839
CVE-2021-0561
CVE-2022-32208
CVE-2022-32207
CVE-2022-32206
CVE-2022-32205
CVE-2022-27782
CVE-2022-27781
CVE-2022-27775
CVE-2022-22576
CVE-2021-22947
CVE-2021-22946
CVE-2021-22945
CVE-2021-22924
CVE-2021-22898
CVE-2021-33655
CVE-2022-29838
CWE-ID CWE-200
CWE-522
CWE-125
CWE-347
CWE-276
CWE-400
CWE-303
CWE-835
CWE-399
CWE-287
CWE-345
CWE-319
CWE-415
CWE-295
CWE-457
CWE-787
Exploitation vector Network
Public exploit N/A
Vulnerable software
Subscribe 		My Cloud Mirror G2
Hardware solutions / Other hardware appliances

WD Cloud
Hardware solutions / Other hardware appliances

My Cloud EX2100
Hardware solutions / Other hardware appliances

My Cloud DL4100
Hardware solutions / Other hardware appliances

My Cloud DL2100
Hardware solutions / Other hardware appliances

My Cloud EX4100
Hardware solutions / Other hardware appliances

My Cloud EX2 Ultra
Hardware solutions / Other hardware appliances

My Cloud PR4100
Hardware solutions / Other hardware appliances

My Cloud PR2100
Hardware solutions / Other hardware appliances

My Cloud
Hardware solutions / Office equipment, IP-phones, print servers

My Cloud OS 5
Operating systems & Components / Operating system

Vendor Western Digital

Security Bulletin

This security bulletin contains information about 18 vulnerabilities.

1) Information disclosure

EUVDB-ID: #VU62644

Risk: Low

CVSSv3.1: 3.2 [CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-27776

CWE-ID: CWE-200 - Information exposure

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to curl can leak authentication or cookie header data during HTTP redirects to the same host but another port number. When asked to send custom headers or cookies in its HTTP requests, curl sends that set of headers only to the host which name is used in the initial URL, so that redirects to other hosts will make curl send the data to those. However, due to a flawed check, curl wrongly also sends that same set of headers to the hosts that are identical to the first one but use a different port number or URL scheme.

The vulnerability exists due to an incomplete fix for #VU10224 (CVE-2018-1000007).

Mitigation

Install update from vendor's website.

Vulnerable software versions

My Cloud Mirror G2: All versions

WD Cloud: All versions

My Cloud: All versions

My Cloud EX2100: All versions

My Cloud DL4100: All versions

My Cloud DL2100: All versions

My Cloud EX4100: All versions

My Cloud EX2 Ultra: All versions

My Cloud PR4100: All versions

My Cloud PR2100: All versions

My Cloud OS 5: before 5.25.124

External links

http://www.westerndigital.com/support/product-security/wdc-22019-my-cloud-firmware-version-5-25-124


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Insufficiently protected credentials

EUVDB-ID: #VU69921

Risk: Medium

CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-29839

CWE-ID: CWE-522 - Insufficiently Protected Credentials

Exploit availability: No

Description

The vulnerability allows a remote attacker to compromise the target system.

The vulnerability exists due to insufficiently protected credentials. A remote attacker can gain access protected data.

Mitigation

Install update from vendor's website.

Vulnerable software versions

My Cloud Mirror G2: All versions

WD Cloud: All versions

My Cloud: All versions

My Cloud EX2100: All versions

My Cloud DL4100: All versions

My Cloud DL2100: All versions

My Cloud EX4100: All versions

My Cloud EX2 Ultra: All versions

My Cloud PR4100: All versions

My Cloud PR2100: All versions

My Cloud OS 5: before 5.25.124

External links

http://www.westerndigital.com/support/product-security/wdc-22019-my-cloud-firmware-version-5-25-124


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Out-of-bounds read

EUVDB-ID: #VU69342

Risk: Low

CVSSv3.1: 2.2 [CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-0561

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

Description

The vulnerability allows a local application to gain access to potentially sensitive information.

The vulnerability exists due to a boundary condition within the append_to_verify_fifo_interleaved_ in stream_encoder.c in Media Framework. A local application can trigger an out-of-bounds read error and read contents of memory on the system.

Mitigation

Install update from vendor's website.

Vulnerable software versions

My Cloud Mirror G2: All versions

WD Cloud: All versions

My Cloud: All versions

My Cloud EX2100: All versions

My Cloud DL4100: All versions

My Cloud DL2100: All versions

My Cloud EX4100: All versions

My Cloud EX2 Ultra: All versions

My Cloud PR4100: All versions

My Cloud PR2100: All versions

My Cloud OS 5: before 5.25.124

External links

http://www.westerndigital.com/support/product-security/wdc-22019-my-cloud-firmware-version-5-25-124


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Improper Verification of Cryptographic Signature

EUVDB-ID: #VU64685

Risk: Medium

CVSSv3.1: 4.2 [CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-32208

CWE-ID: CWE-347 - Improper Verification of Cryptographic Signature

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform MitM attack.

The vulnerability exists due to improper handling of message verification failures when performing FTP transfers secured by krb5. A remote attacker can perform MitM attack and manipulate data.

Mitigation

Install update from vendor's website.

Vulnerable software versions

My Cloud Mirror G2: All versions

WD Cloud: All versions

My Cloud: All versions

My Cloud EX2100: All versions

My Cloud DL4100: All versions

My Cloud DL2100: All versions

My Cloud EX4100: All versions

My Cloud EX2 Ultra: All versions

My Cloud PR4100: All versions

My Cloud PR2100: All versions

My Cloud OS 5: before 5.25.124

External links

http://www.westerndigital.com/support/product-security/wdc-22019-my-cloud-firmware-version-5-25-124


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

5) Incorrect default permissions

EUVDB-ID: #VU64684

Risk: Low

CVSSv3.1: 2.9 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-32207

CWE-ID: CWE-276 - Incorrect Default Permissions

Exploit availability: No

Description

The vulnerability allows a local user to gain access to sensitive information.

The vulnerability exists due to incorrect default permissions set to cookies, alt-svc and hsts data stored in local files. A local user with ability to read such files can gain access to potentially sensitive information.

Mitigation

Install update from vendor's website.

Vulnerable software versions

My Cloud Mirror G2: All versions

WD Cloud: All versions

My Cloud: All versions

My Cloud EX2100: All versions

My Cloud DL4100: All versions

My Cloud DL2100: All versions

My Cloud EX4100: All versions

My Cloud EX2 Ultra: All versions

My Cloud PR4100: All versions

My Cloud PR2100: All versions

My Cloud OS 5: before 5.25.124

External links

http://www.westerndigital.com/support/product-security/wdc-22019-my-cloud-firmware-version-5-25-124


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

6) Resource exhaustion

EUVDB-ID: #VU64682

Risk: Medium

CVSSv3.1: 5.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-32206

CWE-ID: CWE-400 - Resource exhaustion

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insecure processing of compressed HTTP responses. A malicious server can send a specially crafted HTTP response to curl and perform a denial of service attack by forcing curl to spend enormous amounts of allocated heap memory, or trying to and returning out of memory errors.

Mitigation

Install update from vendor's website.

Vulnerable software versions

My Cloud Mirror G2: All versions

WD Cloud: All versions

My Cloud: All versions

My Cloud EX2100: All versions

My Cloud DL4100: All versions

My Cloud DL2100: All versions

My Cloud EX4100: All versions

My Cloud EX2 Ultra: All versions

My Cloud PR4100: All versions

My Cloud PR2100: All versions

My Cloud OS 5: before 5.25.124

External links

http://www.westerndigital.com/support/product-security/wdc-22019-my-cloud-firmware-version-5-25-124


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

7) Resource exhaustion

EUVDB-ID: #VU64681

Risk: Medium

CVSSv3.1: 5.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-32205

CWE-ID: CWE-400 - Resource exhaustion

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to curl does not impose limits to the size of cookies stored in the system. A malicious server can serve excessive amounts of Set-Cookie: headers in a HTTP response to curl and consume all available disk space.

Mitigation

Install update from vendor's website.

Vulnerable software versions

My Cloud Mirror G2: All versions

WD Cloud: All versions

My Cloud: All versions

My Cloud EX2100: All versions

My Cloud DL4100: All versions

My Cloud DL2100: All versions

My Cloud EX4100: All versions

My Cloud EX2 Ultra: All versions

My Cloud PR4100: All versions

My Cloud PR2100: All versions

My Cloud OS 5: before 5.25.124

External links

http://www.westerndigital.com/support/product-security/wdc-22019-my-cloud-firmware-version-5-25-124


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

8) Incorrect Implementation of Authentication Algorithm

EUVDB-ID: #VU63009

Risk: Medium

CVSSv3.1: 4.6 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-27782

CWE-ID: CWE-303 - Incorrect Implementation of Authentication Algorithm

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to the way libcurl handles previously used connections in a connection pool for subsequent transfers. Several TLS and SSH settings were left out from the configuration match checks, resulting in erroneous matches for different resources. As a result, libcurl can send authentication string from one resource to another, exposing credentials to a third-party.

Mitigation

Install update from vendor's website.

Vulnerable software versions

My Cloud Mirror G2: All versions

WD Cloud: All versions

My Cloud: All versions

My Cloud EX2100: All versions

My Cloud DL4100: All versions

My Cloud DL2100: All versions

My Cloud EX4100: All versions

My Cloud EX2 Ultra: All versions

My Cloud PR4100: All versions

My Cloud PR2100: All versions

My Cloud OS 5: before 5.25.124

External links

http://www.westerndigital.com/support/product-security/wdc-22019-my-cloud-firmware-version-5-25-124


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

9) Infinite loop

EUVDB-ID: #VU63008

Risk: Medium

CVSSv3.1: 4.6 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-27781

CWE-ID: CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to infinite loop when handling requests with the CURLOPT_CERTINFO option. A remote attacker can consume all available system resources and cause denial of service conditions.

Mitigation

Install update from vendor's website.

Vulnerable software versions

My Cloud Mirror G2: All versions

WD Cloud: All versions

My Cloud: All versions

My Cloud EX2100: All versions

My Cloud DL4100: All versions

My Cloud DL2100: All versions

My Cloud EX4100: All versions

My Cloud EX2 Ultra: All versions

My Cloud PR4100: All versions

My Cloud PR2100: All versions

My Cloud OS 5: before 5.25.124

External links

http://www.westerndigital.com/support/product-security/wdc-22019-my-cloud-firmware-version-5-25-124


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

10) Resource management error

EUVDB-ID: #VU62643

Risk: Low

CVSSv3.1: 3.2 [CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-27775

CWE-ID: CWE-399 - Resource Management Errors

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to improper management of internal resources when handling IPv6 protocol. Due to errors in the logic, the config matching function did not take the IPv6 address zone id into account which could lead to libcurl reusing the wrong connection when one transfer uses a zone id and a subsequent transfer uses another (or no) zone id.

Mitigation

Install update from vendor's website.

Vulnerable software versions

My Cloud Mirror G2: All versions

WD Cloud: All versions

My Cloud: All versions

My Cloud EX2100: All versions

My Cloud DL4100: All versions

My Cloud DL2100: All versions

My Cloud EX4100: All versions

My Cloud EX2 Ultra: All versions

My Cloud PR4100: All versions

My Cloud PR2100: All versions

My Cloud OS 5: before 5.25.124

External links

http://www.westerndigital.com/support/product-security/wdc-22019-my-cloud-firmware-version-5-25-124


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

11) Improper Authentication

EUVDB-ID: #VU62640

Risk: Medium

CVSSv3.1: 6.4 [CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-22576

CWE-ID: CWE-287 - Improper Authentication

Exploit availability: No

Description

The vulnerability allows a remote attacker to bypass authentication process.

The vulnerability exists due to an error when re-using OAUTH2 connections for SASL-enabled protocols, such as SMPTP(S), IMAP(S), POP3(S) and LDAP(S) (openldap only). libcurl may reuse OAUTH2-authenticated connections without properly making sure that the connection was authenticated with the same credentials as set for this transfer. As a result, a connection that is successfully created and authenticated with a user name + OAUTH2 bearer can subsequently be erroneously reused even for user + [other OAUTH2 bearer], even though that might not even be a valid bearer.

A remote attacker can exploit this vulnerability against applications intended for use in multi-user environments to bypass authentication and gain unauthorized access to victim's accounts.


Mitigation

Install update from vendor's website.

Vulnerable software versions

My Cloud Mirror G2: All versions

WD Cloud: All versions

My Cloud: All versions

My Cloud EX2100: All versions

My Cloud DL4100: All versions

My Cloud DL2100: All versions

My Cloud EX4100: All versions

My Cloud EX2 Ultra: All versions

My Cloud PR4100: All versions

My Cloud PR2100: All versions

My Cloud OS 5: before 5.25.124

External links

http://www.westerndigital.com/support/product-security/wdc-22019-my-cloud-firmware-version-5-25-124


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

12) Insufficient verification of data authenticity

EUVDB-ID: #VU56615

Risk: Medium

CVSSv3.1: 6.2 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-22947

CWE-ID: CWE-345 - Insufficient Verification of Data Authenticity

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform MitM attack.

The vulnerability exists in the way libcurl handles the STARTTLS negotiation process. When curl connects to an IMAP, POP3, SMTP or FTP server to exchange data securely using STARTTLS to upgrade the connection to TLS level, the server can still respond and send back multiple responses before the TLS upgrade. Such multiple "pipelined" responses are cached by curl. curl would then upgrade to TLS but not flush the in-queue of cached responses and instead use and trust the responses it got before the TLS handshake as if they were authenticated.

Using this flaw, it allows a Man-In-The-Middle attacker to first inject the fake responses, then pass-through the TLS traffic from the legitimate server and trick curl into sending data back to the user thinking the attacker's injected data comes from the TLS-protected server.

Over POP3 and IMAP an attacker can inject fake response data.

Mitigation

Install update from vendor's website.

Vulnerable software versions

My Cloud Mirror G2: All versions

WD Cloud: All versions

My Cloud: All versions

My Cloud EX2100: All versions

My Cloud DL4100: All versions

My Cloud DL2100: All versions

My Cloud EX4100: All versions

My Cloud EX2 Ultra: All versions

My Cloud PR4100: All versions

My Cloud PR2100: All versions

My Cloud OS 5: before 5.25.124

External links

http://www.westerndigital.com/support/product-security/wdc-22019-my-cloud-firmware-version-5-25-124


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

13) Cleartext transmission of sensitive information

EUVDB-ID: #VU56613

Risk: Medium

CVSSv3.1: 6.2 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-22946

CWE-ID: CWE-319 - Cleartext Transmission of Sensitive Information

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to an error, related to incorrect enforcement of the --ssl-reqd option on the command line or CURLOPT_USE_SSL setting set to CURLUSESSL_CONTROL or CURLUSESSL_ALL with libcurl. A remote attacker with control over the IMAP, POP3 or FTP server can send a specially crafted but perfectly legitimate response to the libcurl client and force it silently to continue its operations without TLS encryption and transmit data in clear text over the network.

Mitigation

Install update from vendor's website.

Vulnerable software versions

My Cloud Mirror G2: All versions

WD Cloud: All versions

My Cloud: All versions

My Cloud EX2100: All versions

My Cloud DL4100: All versions

My Cloud DL2100: All versions

My Cloud EX4100: All versions

My Cloud EX2 Ultra: All versions

My Cloud PR4100: All versions

My Cloud PR2100: All versions

My Cloud OS 5: before 5.25.124

External links

http://www.westerndigital.com/support/product-security/wdc-22019-my-cloud-firmware-version-5-25-124


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

14) Double Free

EUVDB-ID: #VU56610

Risk: Low

CVSSv3.1: 3.2 [CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-22945

CWE-ID: CWE-415 - Double Free

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary error when sending data to an MQTT server. A remote attacker with ability to control libcurl input can trigger a double free error and perform a denial of service (DoS) attack.

Mitigation

Install update from vendor's website.

Vulnerable software versions

My Cloud Mirror G2: All versions

WD Cloud: All versions

My Cloud: All versions

My Cloud EX2100: All versions

My Cloud DL4100: All versions

My Cloud DL2100: All versions

My Cloud EX4100: All versions

My Cloud EX2 Ultra: All versions

My Cloud PR4100: All versions

My Cloud PR2100: All versions

My Cloud OS 5: before 5.25.124

External links

http://www.westerndigital.com/support/product-security/wdc-22019-my-cloud-firmware-version-5-25-124


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

15) Improper Certificate Validation

EUVDB-ID: #VU55146

Risk: Medium

CVSSv3.1: 4.6 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-22924

CWE-ID: CWE-295 - Improper Certificate Validation

Exploit availability: No

Description

The vulnerability allows a remote attacker to compromise the target system.

The vulnerability exists due to errors in the logic when the config matching function does not take "issuer cert" into account and it compares the involved paths case insensitively. A remote attacker can gain access to sensitive information on the system.

Mitigation

Install update from vendor's website.

Vulnerable software versions

My Cloud Mirror G2: All versions

WD Cloud: All versions

My Cloud: All versions

My Cloud EX2100: All versions

My Cloud DL4100: All versions

My Cloud DL2100: All versions

My Cloud EX4100: All versions

My Cloud EX2 Ultra: All versions

My Cloud PR4100: All versions

My Cloud PR2100: All versions

My Cloud OS 5: before 5.25.124

External links

http://www.westerndigital.com/support/product-security/wdc-22019-my-cloud-firmware-version-5-25-124


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

16) Use of uninitialized variable

EUVDB-ID: #VU53587

Risk: Medium

CVSSv3.1: 4.1 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-22898

CWE-ID: CWE-457 - Use of Uninitialized Variable

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to usage of uninitialized variable in code, responsible for processing TELNET requests when parsing NEW_ENV variables. A remote attacker can force the affected application to connect to a telnet server under attackers control and read up to 1800 bytes from the uninitialized memory on the libcurl client system.

Proof of concept:

curl telnet://example.com -tNEW_ENV=a,bbbbbb (256 'b's)

Mitigation

Install update from vendor's website.

Vulnerable software versions

My Cloud Mirror G2: All versions

WD Cloud: All versions

My Cloud: All versions

My Cloud EX2100: All versions

My Cloud DL4100: All versions

My Cloud DL2100: All versions

My Cloud EX4100: All versions

My Cloud EX2 Ultra: All versions

My Cloud PR4100: All versions

My Cloud PR2100: All versions

My Cloud OS 5: before 5.25.124

External links

http://www.westerndigital.com/support/product-security/wdc-22019-my-cloud-firmware-version-5-25-124


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

17) Out-of-bounds write

EUVDB-ID: #VU65833

Risk: Low

CVSSv3.1: 6.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-33655

CWE-ID: CWE-787 - Out-of-bounds write

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a boundary error in FBIOPUT_VSCREENINFO IOCTL. A local user can trigger an out-of-bounds write error and execute arbitrary code with elevated privileges.

Mitigation

Install update from vendor's website.

Vulnerable software versions

My Cloud Mirror G2: All versions

WD Cloud: All versions

My Cloud: All versions

My Cloud EX2100: All versions

My Cloud DL4100: All versions

My Cloud DL2100: All versions

My Cloud EX4100: All versions

My Cloud EX2 Ultra: All versions

My Cloud PR4100: All versions

My Cloud PR2100: All versions

My Cloud OS 5: before 5.25.124

External links

http://www.westerndigital.com/support/product-security/wdc-22019-my-cloud-firmware-version-5-25-124


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

18) Improper Authentication

EUVDB-ID: #VU69918

Risk: Medium

CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-29838

CWE-ID: CWE-287 - Improper Authentication

Exploit availability: No

Description

The vulnerability allows a remote attacker to bypass authentication process.

The vulnerability exists due to improper authentication within the encrypted volumes and auto mount feature. A remote attacker can gain a direct access to the drive information in the case of a device reset.

Mitigation

Install update from vendor's website.

Vulnerable software versions

My Cloud Mirror G2: All versions

WD Cloud: All versions

My Cloud: All versions

My Cloud EX2100: All versions

My Cloud DL4100: All versions

My Cloud DL2100: All versions

My Cloud EX4100: All versions

My Cloud EX2 Ultra: All versions

My Cloud PR4100: All versions

My Cloud PR2100: All versions

My Cloud OS 5: before 5.25.124

External links

http://www.westerndigital.com/support/product-security/wdc-22019-my-cloud-firmware-version-5-25-124


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.



###SIDEBAR###