CVE-2022-36331CWE-290

Impersonation attack causing an Authentication Bypass on Western Digital devices

Critical · published June 12, 2023

CVSS v3.1
10.0
EPSS
1%
Percentile
47.3
In the wild
Unconfirmed
What it is

🚨 An impersonation attack could let an unauthorized user stroll right into your data stored on Western Digital My Cloud devices! 🔥 Think of your My Cloud device like a secure bank vault, but this vulnerability is the equivalent of someone sneakily copying the vault's key without your knowledge. It allows them to waltz in and access your valuables without any verification! This could lead to an unauthorized person gaining access to all your personal files, photos, and sensitive information, which can be absolutely devastating! With such critical exposure, any unprotected data could be at risk of being stolen or misused, leaving you in a panic!

Put simply

Think of your My Cloud device like a secure bank vault, but this vulnerability is the equivalent of someone sneakily copying the vault's key without your knowledge. It allows them to waltz in and access your valuables without any verification! The vulnerability in My Cloud OS 5 devices allows an attacker to impersonate legitimate users due to inadequate authentication checks, enabling them to access user data without needing any credentials.

What to do

This could lead to an unauthorized person gaining access to all your personal files, photos, and sensitive information, which can be absolutely devastating! With such critical exposure, any unprotected data could be at risk of being stolen or misused, leaving you in a panic! To protect your data, immediately patch your devices to My Cloud OS 5 version 5.25.132 or later for My Cloud, and to version 8.13.1-102 or later for My Cloud Home and SanDisk ibi. Additionally, review your device settings and ensure any other security measures are in place. You've got this! Stay proactive and secure your data with these updates! 🛡️

The record
Technical detail
CVSS v3.1
10.0 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00591 · 47.3th percentile
Weakness
CWE-290 · Authentication Bypass by Spoofing
Published
2023-06-12T17:57Z
EPSS history
Timeline
  • 12 JUN 17:57Z
    Impersonation attack causing an Authentication Bypass on Western Digital devices
    cvelistv5