CVE-2022-36331 — Impersonation attack causing an Authentication Bypass on Western Digital devices

Description (CNA)

Western Digital My Cloud, My Cloud Home, My Cloud Home Duo, and SanDisk ibi devices were vulnerable to an impersonation attack that could allow an unauthenticated attacker to gain access to user data. This issue affects My Cloud OS 5 devices: before 5.25.132; My Cloud Home and My Cloud Home Duo: before 8.13.1-102; SanDisk ibi: before 8.13.1-102.

Affected (CNA)

Vendor / product	Versions
Western Digital / My Cloud OS 5	affected 0 before 5.25.132
Western Digital / My Cloud Home and My Cloud Home Duo	affected 0 before 8.13.1-102
SanDisk / ibi	affected 0 before 8.13.1-102

CWE

CWE-290

References

https://https://www.westerndigital.com/support/product-security/wdc-22020-my-cloud-os-5-my-cloud-home-ibi-firmware-update

ADP enrichment

CVE

No English description supplied.

https://https://www.westerndigital.com/support/product-security/wdc-22020-my-cloud-os-5-my-cloud-home-ibi-firmware-update

CISA-ADP

No English description supplied.

No references supplied.