CVE-2022-36327: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could allow an attacker to write files to locations with…

PriorityP260critical9.8CVSS 3.1

AVNACLPRNUINSUCHIHAH

EPSS

1.47%

70.4th percentile

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could allow an attacker to write files to locations with certain critical filesystem types leading to remote code execution was discovered in Western Digital My Cloud Home, My Cloud Home Duo, SanDisk ibi and Western Digital My Cloud OS 5 devices. This issue requires an authentication bypass issue to be triggered before this can be exploited. This issue affects My Cloud Home and My Cloud Home Duo: before 9.4.0-191; ibi: before 9.4.0-191; My Cloud OS 5: before 5.26.202.

Affected

7 ranges

Vendor	Product	Version range	Fixed in
sandisk	ibi	< 9.4.0-191	9.4.0-191
western_digital	my_cloud_home_and_my_cloud_home_duo	< 9.4.0-191	9.4.0-191
western_digital	my_cloud_os_5	< 5.26.202	5.26.202
westerndigital	my_cloud_home_duo_firmware	< 9.4.0-191	9.4.0-191
westerndigital	my_cloud_home_firmware	< 9.4.0-191	9.4.0-191
westerndigital	my_cloud_os_5	< 5.26.202	5.26.202
westerndigital	sandisk_ibi_firmware	< 9.4.0-191	9.4.0-191

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.