Resource exhaustion in Western Digital products - CVE-2023-22819

Vulnerability identifier: #VU86124

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2023-22819

CWE-ID: CWE-400

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to application does not properly control consumption of internal resources within the RESTSDK server. A remote attacker can trigger resource exhaustion and perform a denial of service (DoS) attack.

My Cloud PR2100
My Cloud PR4100
My Cloud EX4100
My Cloud EX2 Ultra
My Cloud Mirror G2
My Cloud DL2100
My Cloud DL4100
My Cloud EX2100
WD Cloud
My Cloud (Glacier)
My Cloud Home
My Cloud Home Duo
SanDisk ibi

Install updates from vendor's website.

My Cloud PR2100 - update to 5.27.161
My Cloud PR4100 - update to 5.27.161
My Cloud EX4100 - update to 5.27.161
My Cloud EX2 Ultra - update to 5.27.161
My Cloud Mirror G2 - update to 5.27.161
My Cloud DL2100 - update to 5.27.161
My Cloud DL4100 - update to 5.27.161
My Cloud EX2100 - update to 5.27.161
My Cloud (Glacier) - update to 5.27.161
WD Cloud - update to 5.27.161
My Cloud Home - update to 9.5.1-104
My Cloud Home Duo - update to 9.5.1-104
SanDisk ibi - update to 9.5.1-104

• https://www.westerndigital.com/support/product-security/wdc-24001-western-digital-my-cloud-os-5-my-cloud-home-duo-and-sandisk-ibi-firmware-update
• https://www.zerodayinitiative.com/advisories/ZDI-24-088/

• Multiple vulnerabilities in Western Digital My Cloud OS 5, My Cloud Home and SanDisk ibi devices