Test ID:	1.3.6.1.4.1.25623.1.0.149702
Category:	General
Title:	Western Digital My Cloud Multiple Products 5.x < 5.26.202 Multiple Vulnerabilities (WDC-23006, WDC-23009)
Summary:	Multiple Western Digital My Cloud products are prone to; multiple vulnerabilities.
Description:	Summary: Multiple Western Digital My Cloud products are prone to multiple vulnerabilities. Vulnerability Insight: The following vulnerabilities exist: - CVE-2022-36326: Uncontrolled resource consumption vulnerability that could arise by sending crafted requests to a service to consume a large amount of memory, eventually resulting in the service being stopped and restarted. - CVE-2022-36327: Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability that could allow an attacker to write files to locations with certain critical filesystem types leading to remote code execution. - CVE-2022-36328: Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability that could allow an attacker to create arbitrary shares on arbitrary directories and exfiltrate sensitive files, passwords, users and device configurations. - CVE-2022-29840: Server-side request forgery (SSRF) vulnerability that could allow a rogue server on the local network to modify its URL to point back to the loopback adapter. - CVE-2023-22814: Vulnerability in the token-based authentication mechanism that could allow an attacker to carry out an impersonation attack. Affected Software/OS: Western Digital My Cloud PR2100, My Cloud PR4100, My Cloud EX4100, My Cloud EX2 Ultra, My Cloud Mirror Gen 2, My Cloud DL2100, My Cloud DL4100, My Cloud EX2100, My Cloud and WD Cloud with firmware prior to version 5.26.202. Solution: Update to firmware version 5.26.202 or later. CVSS Score: 10.0 CVSS Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2022-36326 https://www.westerndigital.com/support/product-security/wdc-23003-western-digital-my-cloud-home-my-cloud-home-duo-and-sandisk-ibi-firmware-version-9-4-0-191 https://www.westerndigital.com/support/product-security/wdc-23006-my-cloud-firmware-version-5-26-202 Common Vulnerability Exposure (CVE) ID: CVE-2022-36327 Common Vulnerability Exposure (CVE) ID: CVE-2022-36328 Common Vulnerability Exposure (CVE) ID: CVE-2022-29840 Common Vulnerability Exposure (CVE) ID: CVE-2023-22814
Copyright	Copyright (C) 2023 Greenbone AG

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.