westerndigital vulnerabilities

Recent CVEs affecting westerndigital products. 24 tracked.

westerndigital has 24 tracked vulnerabilities, 5 critical. A fixed release or vendor patch exists for 24. Most recent: 2023-11-15. Highest priority: CVE-2021-36224 (score 61/100).

CVE-2023-22818 HIGH 7.3 UPGRADE Multiple DLL Search Order Hijack vulnerabilities were addressed in the SanDisk Security Installer for Windows
CVE-2023-22814 CRITICAL 10.0 UPGRADE An authentication bypass issue via spoofing was discovered in the token-based authentication mechanism that co
CVE-2023-22813 LOW 3.3 UPGRADE UPGRADE A device API endpoint was missing access controls on Western Digital My Cloud OS 5 iOS and Anroid Mo
CVE-2023-22812 HIGH 7.4 UPGRADE SanDisk PrivateAccess versions prior to 6.4.9 support insecure TLS 1.0 and TLS 1.1 protocols which are suscept
CVE-2022-36331 CRITICAL 10.0 UPGRADE UPGRADE Western Digital My Cloud, My Cloud Home, My Cloud Home Duo, and SanDisk ibi devices were vulnerable to an impe
CVE-2022-36330 LOW 1.9 UPGRADE UPGRADE A buffer overflow vulnerability was discovered on firmware version validation that could lead to an unauthenti
CVE-2022-36329 MEDIUM 4.4 UPGRADE UPGRADE An improper privilege management issue that could allow an attacker to cause a denial of service over the OTA
CVE-2022-36328 MEDIUM 5.8 UPGRADE UPGRADE Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could allow
CVE-2022-36327 MEDIUM 5.8 UPGRADE UPGRADE Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could allow
CVE-2022-36326 MEDIUM 4.4 UPGRADE UPGRADE An uncontrolled resource consumption vulnerability issue that could arise by sending crafted requests to a ser
CVE-2022-29844 MEDIUM 6.7 UPGRADE UPGRADE A vulnerability in the FTP service of Western Digital My Cloud OS 5 devices running firmware versions prior to
CVE-2022-29843 MEDIUM 6.2 UPGRADE UPGRADE A command injection vulnerability in the DDNS service configuration of Western Digital My Cloud OS 5 devices r
CVE-2022-29842 CRITICAL 9.8 UPGRADE Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability that could a
CVE-2022-29841 HIGH 8.0 UPGRADE Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability that
CVE-2022-29840 MEDIUM 5.1 UPGRADE Server-Side Request Forgery (SSRF) vulnerability that could allow a rogue server on the local network to modif
CVE-2022-29839 MEDIUM 4.1 UPGRADE Insufficiently Protected Credentials vulnerability in the remote backups application on Western Digital My Clo
CVE-2022-29838 MEDIUM 4.3 UPGRADE Improper Authentication vulnerability in the encrypted volumes and auto mount features of Western Digital My C
CVE-2022-29837 MEDIUM 4.7 UPGRADE UPGRADE A path traversal vulnerability was addressed in Western Digital My Cloud Home, My Cloud Home Duo and SanDisk i
CVE-2022-29836 LOW 1.9 UPGRADE UPGRADE Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability was discovered vi
CVE-2022-29835 MEDIUM 5.3 UPGRADE UPGRADE WD Discovery software executable files were signed with an unsafe SHA-1 hashing algorithm
CVE-2022-23006 LOW 1.8 UPGRADE UPGRADE A stack-based buffer overflow vulnerability was found on Western Digital My Cloud Home, My Cloud Home Duo, and
CVE-2021-36226 CRITICAL 9.8 UPGRADE Western Digital My Cloud devices before OS5 do not use cryptographically signed Firmware upgrade files.
CVE-2021-36225 HIGH 8.8 UPGRADE Western Digital My Cloud devices before OS5 allow REST API access by low-privileged accounts, as demonstrated
CVE-2021-36224 CRITICAL 9.8 UPGRADE Western Digital My Cloud devices before OS5 have a nobody account with a blank password.

FAQ

How do I fix westerndigital vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is westerndigital being exploited right now?

None of the tracked westerndigital CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.

Which westerndigital CVE should I patch first?

CVE-2021-36224 currently ranks highest (61/100): Western Digital My Cloud devices before OS5 have a nobody account with a blank password..

Products

RSS feed for westerndigital · ← Back to latest CVEs