Improper Authentication in Western Digital products - CVE-2022-36331

Vulnerability identifier: #VU77147

CSH Severity: Medium

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2022-36331

CWE-ID: CWE-287

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to bypass authentication process.

The vulnerability exists due to improper authentication within the way the device connects with cloud services. A remote attacker can bypass authentication process and gain access to user data.

My Cloud PR2100
My Cloud PR4100
My Cloud EX4100
My Cloud EX2 Ultra
My Cloud Mirror G2
My Cloud DL4100
My Cloud EX2100
WD Cloud
My Cloud
My Cloud Home
My Cloud Home Duo
SanDisk ibi

Install updates from vendor's website.

My Cloud PR2100 - update to 5.25.132
My Cloud PR4100 - update to 5.25.132
My Cloud EX4100 - update to 5.25.132
My Cloud EX2 Ultra - update to 5.25.132
My Cloud Mirror G2 - update to 5.25.132
My Cloud DL4100 - update to 5.25.132
My Cloud EX2100 - update to 5.25.132
My Cloud - update to 5.25.132
WD Cloud - update to 5.25.132
My Cloud Home - update to 8.13.1-102
My Cloud Home Duo - update to 8.13.1-102
SanDisk ibi - update to 8.13.1-102

• https://www.zerodayinitiative.com/advisories/ZDI-23-847/
• https://www.westerndigital.com/support/product-security/wdc-22020-my-cloud-os-5-my-cloud-home-ibi-firmware-update
• https://www.zerodayinitiative.com/advisories/ZDI-23-846/

• Improper Authentication in Western Digital My Cloud, My Cloud Home, My Cloud Home Duo and SanDisk ibi devices