CVE-2022-36329

An improper privilege management issue that could allow an attacker to cause a denial of service over the OTA mechanism was discovered in Western Digital My Cloud Home, My Cloud Home Duo and SanDisk ibi devices.This issue affects My Cloud Home and My Cloud Home Duo: before 9.4.0-191; ibi: before 9.4.0-191.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://www.westerndigital.com/support/product-security/wdc-23003-western-digital-my-cloud-home-my-cloud-home-duo-and-sandisk-ibi-firmware-version-9-4-0-191	Vendor Advisory

Configurations

Configuration 1 (hide)

AND

cpe:2.3:o:westerndigital:my_cloud_home_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:westerndigital:my_cloud_home:-:*:*:*:*:*:*:*

Configuration 2 (hide)

AND

cpe:2.3:o:westerndigital:my_cloud_home_duo_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:westerndigital:my_cloud_home_duo:-:*:*:*:*:*:*:*

Configuration 3 (hide)

AND

cpe:2.3:o:westerndigital:sandisk_ibi_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:westerndigital:sandisk_ibi:-:*:*:*:*:*:*:*

History

No history.

Information

Published : 2023-05-10 20:15

Updated : 2024-02-28 20:13

NVD link : CVE-2022-36329

Mitre link : CVE-2022-36329

CVE.ORG link : CVE-2022-36329

JSON object : View

Products Affected

westerndigital

my_cloud_home_duo_firmware
my_cloud_home_duo
my_cloud_home_firmware
sandisk_ibi
my_cloud_home
sandisk_ibi_firmware

CWE

NVD-CWE-noinfo CWE-400

Uncontrolled Resource Consumption

{"id": "CVE-2022-36329", "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}, {"type": "Secondary", "source": "psirt@wdc.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.4, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 0.8}]}, "published": "2023-05-10T20:15:09.530", "references": [{"url": "https://www.westerndigital.com/support/product-security/wdc-23003-western-digital-my-cloud-home-my-cloud-home-duo-and-sandisk-ibi-firmware-version-9-4-0-191", "tags": ["Vendor Advisory"], "source": "psirt@wdc.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}, {"type": "Secondary", "source": "psirt@wdc.com", "description": [{"lang": "en", "value": "CWE-400"}]}], "descriptions": [{"lang": "en", "value": "An improper privilege management issue that could allow an attacker to cause a denial of service over the OTA mechanism was discovered in Western Digital My Cloud Home, My Cloud Home Duo and SanDisk ibi devices.This issue affects My Cloud Home and My Cloud Home Duo: before 9.4.0-191; ibi: before 9.4.0-191.\n\n"}], "lastModified": "2023-05-18T21:20:43.717", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:westerndigital:my_cloud_home_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D471C39A-0854-4755-9DF8-5BAABAB09619", "versionEndExcluding": "9.4.0-191"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:westerndigital:my_cloud_home:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "2BE2FBAB-5BA0-4F09-A76E-4A6869668810"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:westerndigital:my_cloud_home_duo_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0A0368E6-53C8-4BD2-B0E8-44464B245832", "versionEndExcluding": "9.4.0-191"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:westerndigital:my_cloud_home_duo:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "124BBC79-65A2-465C-B784-D21E57E96F63"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:westerndigital:sandisk_ibi_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "13A2FB91-CCCF-42B1-BCE1-F4962D353593", "versionEndExcluding": "9.4.0-191"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:westerndigital:sandisk_ibi:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "296ADA43-16BA-4444-B472-DB945FB917B2"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "psirt@wdc.com"}