Vulnerability identifier: #VU65773

Vulnerability risk: Low

CVSSv3.1: 6.4 [CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-23000

CWE-ID: CWE-757

Exploitation vector: Local

Exploit availability: No

Vulnerable software:
My Cloud PR2100
Hardware solutions / Other hardware appliances
My Cloud PR4100
Hardware solutions / Other hardware appliances
My Cloud EX4100
Hardware solutions / Other hardware appliances
My Cloud EX2 Ultra
Hardware solutions / Other hardware appliances
My Cloud Mirror G2
Hardware solutions / Other hardware appliances
My Cloud DL2100
Hardware solutions / Other hardware appliances
My Cloud DL4100
Hardware solutions / Other hardware appliances
My Cloud EX2100
Hardware solutions / Other hardware appliances
WD Cloud
Hardware solutions / Other hardware appliances
My Cloud
Hardware solutions / Office equipment, IP-phones, print servers
My Cloud OS 5
Operating systems & Components / Operating system

Vendor: Western Digital

Description

The vulnerability allows a local attacker to bypass certain security restrictions.

The vulnerability exists due to a weak SSLContext when attempting to configure port forwarding rules. A local attacker can jeopardize the integrity, confidentiality and authenticity of information transmitted.

Mitigation
Install updates from vendor's website.

Vulnerable software versions

My Cloud PR2100: All versions

My Cloud PR4100: All versions

My Cloud EX4100: All versions

My Cloud EX2 Ultra: All versions

My Cloud Mirror G2: All versions

My Cloud DL2100: All versions

My Cloud DL4100: All versions

My Cloud EX2100: All versions

My Cloud: All versions

WD Cloud: All versions

---

External links
http://www.westerndigital.com/support/product-security/wdc-22011-my-cloud-firmware-version-5-23-114

---

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.