CVE-2022-23006: A stack-based buffer overflow vulnerability was found on Western Digital My Cloud Home, My Cloud Home Duo, and

Q: How do I fix CVE-2022-23006?

my cloud home firmware: upgrade to 8.10.0-117; my cloud home duo firmware: upgrade to 8.10.0-117; sandisk ibi firmware: upgrade to 8.10.0-117. Exact commands for each OS are on this page.

Q: Is CVE-2022-23006 being exploited?

CVE-2022-23006 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

Q: What does CVE-2022-23006 affect?

CVE-2022-23006 affects my cloud home firmware, my cloud home duo firmware, sandisk ibi firmware. Severity is low (CVSS 1.8). A stack-based buffer overflow vulnerability was found on Western Digital My Cloud Home, My Cloud Home Duo, and SanDisk ibi that could allow an attacker accessing the system locally to read information from /etc/version file. This vulnerabil

Q: How urgent is CVE-2022-23006?

Priority 12/100. No elevated risk signals yet.

Routine

LOW 1.8UPGRADEUPGRADEUPGRADE

CVE-2022-23006 is a low-severity flaw (CVSS 1.8) affecting my cloud home firmware, my cloud home duo firmware, sandisk ibi firmware. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

A stack-based buffer overflow vulnerability was found on Western Digital My Cloud Home, My Cloud Home Duo, and SanDisk ibi that could allow an attacker accessing the system locally to read information from /etc/version file. This vulnerability can only be exploited by chaining it with another issue. If an attacker is able to carry out a remote code execution attack, they can gain access to the vulnerable file, due to the presence of insecure func

Why this priority

No elevated risk signals yet

A fixed release or distro patch exists.

Risk facts

CVSS score	1.8 (Low)
Attack vector	Local
Attack complexity	High
Privileges needed	High
User interaction	Required
EPSS exploit chance	0.3% (top 76%)
CISA exploited list	No
Weakness	CWE-121, CWE-787
Published	2022-09-27
Last modified	2026-06-17

Publisher (CNA): Western Digital · Vendor: westerndigital

Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score

Am I affected?

Timeline

2022-09-27 23:15 UTCPublished CVE record published
2026-06-17 04:29 UTCUpdated Record last modified

westerndigital my cloud home firmware UPGRADE

Affected: < 8.10.0-117

Fixed in: 8.10.0-117

Safe to downgrade to: no unaffected older release

Check your OS release

cat /etc/os-release; uname -r

Debian / Ubuntu

sudo apt update && sudo apt full-upgrade

RHEL / Amazon Linux / Fedora

sudo dnf upgrade --refresh

Windows

Install the latest cumulative update from Windows Update

If no patch exists yet

OS downgrades are not safe. Apply the vendor mitigation from the advisory and restrict exposure.

westerndigital my cloud home duo firmware UPGRADE

Affected: < 8.10.0-117

Fixed in: 8.10.0-117

Safe to downgrade to: no unaffected older release

Check your OS release

cat /etc/os-release; uname -r

Debian / Ubuntu

sudo apt update && sudo apt full-upgrade

RHEL / Amazon Linux / Fedora

sudo dnf upgrade --refresh

Windows

Install the latest cumulative update from Windows Update

If no patch exists yet

OS downgrades are not safe. Apply the vendor mitigation from the advisory and restrict exposure.

westerndigital sandisk ibi firmware UPGRADE

Affected: < 8.10.0-117

Fixed in: 8.10.0-117

Safe to downgrade to: no unaffected older release

Check your OS release

cat /etc/os-release; uname -r

Debian / Ubuntu

sudo apt update && sudo apt full-upgrade

RHEL / Amazon Linux / Fedora

sudo dnf upgrade --refresh

Windows

Install the latest cumulative update from Windows Update

If no patch exists yet

OS downgrades are not safe. Apply the vendor mitigation from the advisory and restrict exposure.

Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2022-23006?

my cloud home firmware: upgrade to 8.10.0-117; my cloud home duo firmware: upgrade to 8.10.0-117; sandisk ibi firmware: upgrade to 8.10.0-117. Exact commands for each OS are on this page.

Is CVE-2022-23006 being exploited?

CVE-2022-23006 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

What does CVE-2022-23006 affect?

CVE-2022-23006 affects my cloud home firmware, my cloud home duo firmware, sandisk ibi firmware. Severity is low (CVSS 1.8). A stack-based buffer overflow vulnerability was found on Western Digital My Cloud Home, My Cloud Home Duo, and SanDisk ibi that could allow an attacker accessing the system locally to read information from /etc/version file. This vulnerabil

How urgent is CVE-2022-23006?

Priority 12/100. No elevated risk signals yet.

Software pages

Western Digital vulnerabilities

Related CVEs

CVE-2022-36330 LOW 1.9 UPGRADE UPGRADE A buffer overflow vulnerability was discovered on firmware version validation that could lead to an unauthenti
CVE-2022-36329 MEDIUM 4.4 UPGRADE UPGRADE An improper privilege management issue that could allow an attacker to cause a denial of service over the OTA
CVE-2022-36328 MEDIUM 5.8 UPGRADE UPGRADE Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could allow
CVE-2022-36327 MEDIUM 5.8 UPGRADE UPGRADE Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could allow
CVE-2022-36326 MEDIUM 4.4 UPGRADE UPGRADE An uncontrolled resource consumption vulnerability issue that could arise by sending crafted requests to a ser

References

← Back to latest CVEs