Vulnerabilities > Westerndigital
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2023-01-26 | CVE-2022-29843 | OS Command Injection vulnerability in Westerndigital products A command injection vulnerability in the DDNS service configuration of Western Digital My Cloud OS 5 devices running firmware versions prior to 5.26.119 allows an attacker to execute code in the context of the root user. | 9.8 |
| 2023-01-26 | CVE-2022-29844 | Path Traversal vulnerability in Westerndigital products A vulnerability in the FTP service of Western Digital My Cloud OS 5 devices running firmware versions prior to 5.26.119 allows an attacker to read and write arbitrary files. | 9.8 |
| 2022-12-09 | CVE-2022-29838 | Improper Authentication vulnerability in Westerndigital MY Cloud OS Improper Authentication vulnerability in the encrypted volumes and auto mount features of Western Digital My Cloud devices allows insecure direct access to the drive information in the case of a device reset. | 4.6 |
| 2022-12-09 | CVE-2022-29839 | Insufficiently Protected Credentials vulnerability in Westerndigital MY Cloud OS Insufficiently Protected Credentials vulnerability in the remote backups application on Western Digital My Cloud devices that could allow an attacker who has gained access to a relevant endpoint to use that information to access protected data. | 5.5 |
| 2022-12-01 | CVE-2022-29837 | Path Traversal vulnerability in Westerndigital products A path traversal vulnerability was addressed in Western Digital My Cloud Home, My Cloud Home Duo and SanDisk ibi which could allow an attacker to initiate installation of custom ZIP packages and overwrite system files. | 7.8 |
| 2022-11-09 | CVE-2022-29836 | Path Traversal vulnerability in Westerndigital products Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability was discovered via an HTTP API on Western Digital My Cloud Home; My Cloud Home Duo; and SanDisk ibi devices that could allow an attacker to abuse certain parameters to point to random locations on the file system. | 4.3 |
| 2022-09-27 | CVE-2022-23006 | Out-of-bounds Write vulnerability in Westerndigital products A stack-based buffer overflow vulnerability was found on Western Digital My Cloud Home, My Cloud Home Duo, and SanDisk ibi that could allow an attacker accessing the system locally to read information from /etc/version file. | 6.7 |
| 2022-09-19 | CVE-2022-29835 | Inadequate Encryption Strength vulnerability in Westerndigital WD Discovery 4.0.251.0 WD Discovery software executable files were signed with an unsafe SHA-1 hashing algorithm. | 5.3 |
| 2022-07-29 | CVE-2022-23001 | Incorrect Calculation vulnerability in Westerndigital Sweet B 1 When compressing or decompressing elliptic curve points using the Sweet B library, an incorrect choice of sign bit is used. | 5.3 |
| 2022-07-29 | CVE-2022-23002 | Unspecified vulnerability in Westerndigital Sweet B 1 When compressing or decompressing a point on the NIST P-256 elliptic curve with an X coordinate of zero, the resulting output is not properly reduced modulo the P-256 field prime and is invalid. | 5.3 |