Known vulnerabilities in My Cloud Home Duo

Vendor: Western Digital
Software: My Cloud Home Duo
Software CPE: cpe:2.3:a:western_digital:my_cloud_home_duo:*:*:*:*:*:*:*:*
Website: https://www.wdc.com/
Total vulnerabilities: 18
Public exploits: 2
Known exploited (KEV): 1
Highest CVSSv4 Score: 9.4

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting My Cloud Home Duo My Cloud Home Duo is affected by 18 known vulnerabilities: 5 high, 10 medium, 3 low Critical High Medium Low

Vulnerabilities (18)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU94762 - Incorrect Authorization
CVE-2024-41110		 CWE-863 Medium
No
No
 9.8.0-102 26.07.2024 SB2024072641
SB2024080330
SB2024080739
and 39 more
#VU86124 - Resource exhaustion
CVE-2023-22819		 CWE-400 Medium
No
No
 9.5.1-104 06.02.2024 SB2024020608
#VU86123 - Server-Side Request Forgery (SSRF)
CVE-2023-22817		 CWE-918 High
No
No
 9.5.1-104 06.02.2024 SB2024020608
#VU81874 - Exposure of sensitive information to an unauthorized actor
CVE-2023-4154		 CWE-200 Medium
No
No
 9.7.0-104 11.10.2023 SB2023101133
SB2023101134
SB2023101137
and 17 more
#VU81865 - Heap-based Buffer Overflow
CVE-2023-38545		 CWE-122 High
Available
No
 9.7.0-104 11.10.2023 SB2023101129
SB2023101135
SB2023101149
and 99 more
#VU81863 - External Control of File Name or Path
CVE-2023-38546		 CWE-73 Low
No
No
 9.7.0-104 11.10.2023 SB2023101129
SB2023101135
SB2023101149
and 125 more
#VU81437 - Memory corruption
CVE-2023-4911		 CWE-119 Low
Available
Exploited
 9.8.0-102 03.10.2023 SB2023100343
SB2023100345
SB2023100402
and 94 more
#VU77147 - Improper Authentication
CVE-2022-36331		 CWE-287 Medium
No
No
 8.13.1-102 12.06.2023 SB2023061209
#VU72623 - Memory corruption
CVE-2022-36330		 CWE-119 High
No
No
 9.4.0-191 28.02.2023 SB2023022826
#VU72622 - Improper Privilege Management
CVE-2022-36329		 CWE-269 Medium
No
No
 9.4.0-191 28.02.2023 SB2023022826
#VU72621 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVE-2022-36328		 CWE-22 Medium
No
No
 9.4.0-191 28.02.2023 SB2023022826
#VU72620 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVE-2022-36327		 CWE-22 High
No
No
 9.4.0-191 28.02.2023 SB2023022826
#VU72619 - Resource exhaustion
CVE-2022-36326		 CWE-400 Medium
No
No
 9.4.0-191 28.02.2023 SB2023022826
#VU70656 - Server-Side Request Forgery (SSRF)
CVE-2022-29840		 CWE-918 High
No
No
 8.13.1-102 03.01.2023 SB2023010319
#VU70598 - NULL Pointer Dereference
CVE-2022-3109		 CWE-476 Medium
No
No
 9.8.0-102 02.01.2023 SB2023010231
SB2023010234
SB2023010235
and 12 more
#VU69273 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVE-2022-29836		 CWE-22 Medium
No
No
 8.11.0-113 14.11.2022 SB2022111413
#VU67661 - Improper input validation
CVE-2022-23007		 CWE-20 Low
No
No
 8.10.0-117 27.09.2022 SB2022092708
#VU67660 - Memory corruption
CVE-2022-23006		 CWE-119 Medium
No
No
 8.10.0-117 27.09.2022 SB2022092708