Improper Authentication in Western Digital My Cloud, My Cloud Home, My Cloud Home Duo and SanDisk ibi devices

Published: 2023-06-12

Risk	Medium
Patch available	YES
Number of vulnerabilities	1
CVE-ID	CVE-2022-36331
CWE-ID	CWE-287
Exploitation vector	Network
Public exploit	N/A
Vulnerable software Subscribe	My Cloud PR2100 Hardware solutions / Other hardware appliances My Cloud PR4100 Hardware solutions / Other hardware appliances My Cloud EX4100 Hardware solutions / Other hardware appliances My Cloud EX2 Ultra Hardware solutions / Other hardware appliances My Cloud Mirror G2 Hardware solutions / Other hardware appliances My Cloud DL4100 Hardware solutions / Other hardware appliances My Cloud EX2100 Hardware solutions / Other hardware appliances WD Cloud Hardware solutions / Other hardware appliances My Cloud Hardware solutions / Office equipment, IP-phones, print servers My Cloud Home Client/Desktop applications / Other client software My Cloud Home Duo Client/Desktop applications / Other client software SanDisk ibi Client/Desktop applications / Other client software
Vendor

Security Bulletin

This security bulletin contains one medium risk vulnerability.

1) Improper Authentication

EUVDB-ID: #VU77147

Risk: Medium

CVSSv3.1: 5.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-36331

CWE-ID: CWE-287 - Improper Authentication

Exploit availability: No

Description

The vulnerability allows a remote attacker to bypass authentication process.

The vulnerability exists due to improper authentication within the way the device connects with cloud services. A remote attacker can bypass authentication process and gain access to user data.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

My Cloud PR2100: before 5.25.132

My Cloud PR4100: before 5.25.132

My Cloud EX4100: before 5.25.132

My Cloud EX2 Ultra: before 5.25.132

My Cloud Mirror G2: before 5.25.132

My Cloud DL4100: before 5.25.132

My Cloud EX2100: before 5.25.132

My Cloud: before 5.25.132

WD Cloud: before 5.25.132

My Cloud Home: before 8.13.1-102

My Cloud Home Duo: before 8.13.1-102

SanDisk ibi: before 8.13.1-102

External links

http://www.zerodayinitiative.com/advisories/ZDI-23-847/
http://www.westerndigital.com/support/product-security/wdc-22020-my-cloud-os-5-my-cloud-home-ibi-firmware-update
http://www.zerodayinitiative.com/advisories/ZDI-23-846/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.