CVE-2022-23006
Buffer Overflow Vulnerability in Western Digital My Cloud Home Products and SanDisk ibi
- Published
- Updated
- Reserved
- Assigned by
- WDC PSIRT
Description
A stack-based buffer overflow vulnerability was found on Western Digital My Cloud Home, My Cloud Home Duo, and SanDisk ibi that could allow an attacker accessing the system locally to read information from /etc/version file. This vulnerability can only be exploited by chaining it with another issue. If an attacker is able to carry out a remote code execution attack, they can gain access to the vulnerable file, due to the presence of insecure functions in code. User interaction is required for exploitation. Exploiting the vulnerability could result in exposure of information, ability to modify files, memory access errors, or system crashes.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| WDC PSIRTCNA (assigner) | 3.1 | Low1.8 | CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:L/I:N/A:N |
| NVDNVD · Modified | 3.1 | Medium6.7 | CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H |
- EPSS (exploitation in 30 days)
- 0.31% · top 76% of all CVEs (6 Nov 2026)
- CISA SSVC
- Exploitation: none · Automatable: no · Technical impact: partial
The list uses the assigner's score when there is one, then CISA's, then NVD's: Low 1.8.
Weakness
Affected products
Western Digital · My Cloud Home
- affected 8.10.0-117 – < 8.10.0-117
Western Digital · My Cloud Home Duo
- affected 8.10.0-117 – < 8.10.0-117
- affected 8.10.0-117 – < 8.10.0-117
What to do
Solution: Your device will be automatically updated to the latest firmware version.
References (1)
- https://nvd.nist.gov/vuln/detail/CVE-2022-23006 (opens in a new tab)x_refsource_MISCx_transferred
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2022-23006)Record last updated .