CVE-2022-29837: Path traversal Vulnerability in Western Digital My Cloud Home, My Cloud Home Duo and SanDisk ibi Devices
Published Dec 1, 2022
·Updated
A path traversal vulnerability was addressed in Western Digital My Cloud Home, My Cloud Home Duo and SanDisk ibi which could allow an attacker to initiate installation of custom ZIP packages and overwrite system files. This could potentially lead to a code execution.
Affected Software
6 affected components
WesternDigital My Cloud Home Firmware<8.12.0-178
WesternDigital My Cloud Home
WesternDigital My Cloud Home Duo Firmware<8.12.0-178
WesternDigital My Cloud Home Duo
WesternDigital Sandisk Ibi Firmware<8.12.0-178
WesternDigital Sandisk Ibi
Remediation
Information
The user's My Cloud Home, My Cloud Home Duo and ibi devices will be automatically updated to reflect the latest firmware version.
Event History
Dec 1, 2022
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
RemedyDescriptionSeverityWeakness
Frequently Asked Questions
1
What is the vulnerability ID for this vulnerability?
The vulnerability ID for this vulnerability is CVE-2022-29837.
2
What is the severity of CVE-2022-29837?
The severity of CVE-2022-29837 is high (CVSS score 7.8).
3
Which Western Digital products are affected by CVE-2022-29837?
Western Digital My Cloud Home, My Cloud Home Duo, and SanDisk ibi are affected by CVE-2022-29837.
4
What can an attacker do with CVE-2022-29837?
An attacker can initiate installation of custom ZIP packages and overwrite system files, potentially leading to code execution.
5
How can I fix CVE-2022-29837?
To fix CVE-2022-29837, it is recommended to update the firmware to version 8.12.0-178 or later for the affected Western Digital products.