Algorithm Downgrade in Western Digital products - CVE-2022-23000

Vulnerability identifier: #VU65773

CSH Severity: Low

CVSS v4: 7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2022-23000

CWE-ID: CWE-757

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local attacker to bypass certain security restrictions.

The vulnerability exists due to a weak SSLContext when attempting to configure port forwarding rules. A local attacker can jeopardize the integrity, confidentiality and authenticity of information transmitted.

My Cloud PR2100
My Cloud PR4100
My Cloud EX4100
My Cloud EX2 Ultra
My Cloud Mirror G2
My Cloud DL2100
My Cloud DL4100
My Cloud EX2100
WD Cloud
My Cloud
My Cloud OS 5

Install updates from vendor's website.

My Cloud OS 5 - update to 5.23.114

• https://www.westerndigital.com/support/product-security/wdc-22011-my-cloud-firmware-version-5-23-114

• Multiple vulnerabilities in Western Digital My Cloud OS 5