CVE-2022-36331: Western Digital My Cloud, My Cloud Home, My Cloud Home Duo, and SanDisk ibi devices were vulnerable to an impersonation attack that could allow an…

PriorityP347high7.5CVSS 3.1

AVNACLPRNUINSUCHINAN

EPSS

0.59%

43.8th percentile

Western Digital My Cloud, My Cloud Home, My Cloud Home Duo, and SanDisk ibi devices were vulnerable to an impersonation attack that could allow an unauthenticated attacker to gain access to user data. This issue affects My Cloud OS 5 devices: before 5.25.132; My Cloud Home and My Cloud Home Duo: before 8.13.1-102; SanDisk ibi: before 8.13.1-102.

Affected

15 ranges

Vendor	Product	Version range	Fixed in
sandisk	ibi	< 8.13.1-102	8.13.1-102
western_digital	my_cloud_home_and_my_cloud_home_duo	< 8.13.1-102	8.13.1-102
western_digital	my_cloud_os_5	< 5.25.132	5.25.132
westerndigital	my_cloud_dl2100_firmware	< 5.25.132	5.25.132
westerndigital	my_cloud_dl4100_firmware	< 5.25.132	5.25.132
westerndigital	my_cloud_ex2100_firmware	< 5.25.132	5.25.132
westerndigital	my_cloud_ex2_ultra_firmware	< 5.25.132	5.25.132
westerndigital	my_cloud_ex4100_firmware	< 5.25.132	5.25.132
westerndigital	my_cloud_firmware	< 5.25.132	5.25.132
westerndigital	my_cloud_home_duo_firmware	< 8.13.1-102	8.13.1-102
westerndigital	my_cloud_home_firmware	< 8.13.1-102	8.13.1-102
westerndigital	my_cloud_mirror_g2_firmware	< 5.25.132	5.25.132
westerndigital	my_cloud_pr2100_firmware	< 5.25.132	5.25.132
westerndigital	my_cloud_pr4100_firmware	< 5.25.132	5.25.132
westerndigital	sandisk_ibi_firmware	< 8.13.1-102	8.13.1-102

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.