CVE-2022-29837: Path traversal Vulnerability in Western Digital My Cloud Home, My Cloud Home Duo and SanDisk ibi Devices
First published: Thu Dec 01 2022(Updated: )
A path traversal vulnerability was addressed in Western Digital My Cloud Home, My Cloud Home Duo and SanDisk ibi which could allow an attacker to initiate installation of custom ZIP packages and overwrite system files. This could potentially lead to a code execution.
Credit: psirt@wdc.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Westerndigital My Cloud Home Firmware | <8.12.0-178 | |
| Westerndigital My Cloud Home | ||
| Westerndigital My Cloud Home Duo Firmware | <8.12.0-178 | |
| Westerndigital My Cloud Home Duo | ||
| Westerndigital Sandisk Ibi Firmware | <8.12.0-178 | |
| Westerndigital Sandisk Ibi |
Remedy
The user's My Cloud Home, My Cloud Home Duo and ibi devices will be automatically updated to reflect the latest firmware version.
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Frequently Asked Questions
What is the vulnerability ID for this vulnerability?
The vulnerability ID for this vulnerability is CVE-2022-29837.
What is the severity of CVE-2022-29837?
The severity of CVE-2022-29837 is high (CVSS score 7.8).
Which Western Digital products are affected by CVE-2022-29837?
Western Digital My Cloud Home, My Cloud Home Duo, and SanDisk ibi are affected by CVE-2022-29837.
What can an attacker do with CVE-2022-29837?
An attacker can initiate installation of custom ZIP packages and overwrite system files, potentially leading to code execution.
How can I fix CVE-2022-29837?
To fix CVE-2022-29837, it is recommended to update the firmware to version 8.12.0-178 or later for the affected Western Digital products.
- collector/nvd-index
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/author
- agent/title
- agent/remedy
- agent/references
- agent/weakness
- agent/last-modified-date
- agent/description
- agent/tags
- agent/first-publish-date
- agent/event
- vendor/westerndigital
- canonical/westerndigital my cloud home firmware
- canonical/westerndigital my cloud home
- canonical/westerndigital my cloud home duo firmware
- canonical/westerndigital my cloud home duo
- canonical/westerndigital sandisk ibi firmware
- canonical/westerndigital sandisk ibi