Westerndigital
83 CVEs across 194 Westerndigital products. Browse Westerndigital vulnerabilities, severities, and proof-of-concept exploits.
Westerndigital products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-22819 | Medium | 4.9 | 2024-02-05 | An uncontrolled resource consumption vulnerability issue that could arise by sending crafted requests to a service to consume a large amount of memory, eventua… |
CVE-2023-22817 | Medium | 5.5 | 2024-02-05 | Server-side request forgery (SSRF) vulnerability that could allow a rogue server on the local network to modify its URL using another DNS address to point back… |
CVE-2023-22818 | High | 7.3 | 2023-11-15 | Multiple DLL Search Order Hijack vulnerabilities were addressed in the SanDisk Security Installer for Windows that could allow attackers with local access to e… |
CVE-2023-22814 | Critical | 10.0 | 2023-07-01 | An authentication bypass issue via spoofing was discovered in the token-based authentication mechanism that could allow an attacker to carry out an impersonati… |
CVE-2023-22816 | Medium | 6.0 | 2023-06-30 | A post-authentication remote command injection vulnerability in a CGI file in Western Digital My Cloud OS 5 devices that could allow an attacker to build files… |
CVE-2023-22815 | Medium | 6.2 | 2023-06-30 | Post-authentication remote command injection vulnerability in Western Digital My Cloud OS 5 devices that could allow an attacker to execute code in the context… |
CVE-2022-36331 | Critical | 10.0 | 2023-06-12 | Western Digital My Cloud, My Cloud Home, My Cloud Home Duo, and SanDisk ibi devices were vulnerable to an impersonation attack that could allow an unauthentica… |
CVE-2022-36328 | Medium | 5.8 | 2023-05-18 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could allow an attacker to create arbitrary shares on arbitra… |
CVE-2022-36327 | Medium | 5.8 | 2023-05-18 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could allow an attacker to write files to locations with cert… |
CVE-2022-36326 | Medium | 4.4 | 2023-05-18 | An uncontrolled resource consumption vulnerability issue that could arise by sending crafted requests to a service to consume a large amount of memory, eventua… |
CVE-2022-29840 | Medium | 5.1 | 2023-05-10 | Server-Side Request Forgery (SSRF) vulnerability that could allow a rogue server on the local network to modify its URL to point back to the loopback adapter w… |
CVE-2022-29841 | High | 8.0 | 2023-05-10 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability that was caused by a command that read files from a pr… |
CVE-2022-29842 | Critical | 9.8 | 2023-05-10 | Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability that could allow an attacker to execute code in the context o… |
CVE-2022-36329 | Medium | 4.4 | 2023-05-10 | An improper privilege management issue that could allow an attacker to cause a denial of service over the OTA mechanism was discovered in Western Digital My Cl… |
CVE-2022-36330 | Low | 1.9 | 2023-05-10 | A buffer overflow vulnerability was discovered on firmware version validation that could lead to an unauthenticated remote code execution in Western Digital My… |
CVE-2023-22813 | Low | 3.3 | 2023-05-08 | A device API endpoint was missing access controls on Western Digital My Cloud OS 5 iOS and Anroid Mobile Apps, My Cloud Home iOS and Android Mobile A… |
CVE-2023-22812 | High | 7.4 | 2023-03-24 | SanDisk PrivateAccess versions prior to 6.4.9 support insecure TLS 1.0 and TLS 1.1 protocols which are susceptible to man-in-the-middle attacks thereby comprom… |
CVE-2021-36226 | Critical | 9.8 | 2023-02-06 | Western Digital My Cloud devices before OS5 do not use cryptographically signed Firmware upgrade files. |
CVE-2021-36225 | High | 8.8 | 2023-02-06 | Western Digital My Cloud devices before OS5 allow REST API access by low-privileged accounts, as demonstrated by API commands for firmware uploads and installa… |
CVE-2021-36224 | Critical | 9.8 | 2023-02-06 | Western Digital My Cloud devices before OS5 have a nobody account with a blank password. |
CVE-2022-29844 | Medium | 6.7 | 2023-01-26 | A vulnerability in the FTP service of Western Digital My Cloud OS 5 devices running firmware versions prior to 5.26.119 allows an attacker to read and write ar… |
CVE-2022-29843 | Medium | 6.2 | 2023-01-26 | A command injection vulnerability in the DDNS service configuration of Western Digital My Cloud OS 5 devices running firmware versions prior to 5.26.119 allows… |
CVE-2022-23005 | High | 8.7 | 2023-01-23 | Western Digital has identified a weakness in the UFS standard that could result in a security vulnerability. This vulnerability may exist in some systems where… |
CVE-2022-29839 | Medium | 4.1 | 2022-12-09 | Insufficiently Protected Credentials vulnerability in the remote backups application on Western Digital My Cloud devices that could allow an attacker who has g… |
CVE-2022-29838 | Medium | 4.3 | 2022-12-09 | Improper Authentication vulnerability in the encrypted volumes and auto mount features of Western Digital My Cloud devices allows insecure direct access to the… |
CVE-2022-29837 | Medium | 4.7 | 2022-12-01 | A path traversal vulnerability was addressed in Western Digital My Cloud Home, My Cloud Home Duo and SanDisk ibi which could allow an attacker to initiate inst… |
CVE-2022-29836 | Low | 1.9 | 2022-11-09 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability was discovered via an HTTP API on Western Digital My Cloud Home; M… |
CVE-2022-23006 | Low | 1.8 | 2022-09-27 | A stack-based buffer overflow vulnerability was found on Western Digital My Cloud Home, My Cloud Home Duo, and SanDisk ibi that could allow an attacker accessi… |
CVE-2022-29835 | Medium | 5.3 | 2022-09-19 | WD Discovery software executable files were signed with an unsafe SHA-1 hashing algorithm. An attacker could use this weakness to create forged certificate sig… |
CVE-2022-23004 | Medium | 5.3 | 2022-07-29 | When computing a shared secret or point multiplication on the NIST P-256 curve using a public key with an X coordinate of zero, an error is returned from the l… |
CVE-2022-23003 | Medium | 5.3 | 2022-07-29 | When computing a shared secret or point multiplication on the NIST P-256 curve that results in an X coordinate of zero, the resulting output is not properly re… |
CVE-2022-23002 | Medium | 5.3 | 2022-07-29 | When compressing or decompressing a point on the NIST P-256 elliptic curve with an X coordinate of zero, the resulting output is not properly reduced modulo th… |
CVE-2022-23001 | Medium | 5.3 | 2022-07-29 | When compressing or decompressing elliptic curve points using the Sweet B library, an incorrect choice of sign bit is used. An attacker with user level privile… |
CVE-2022-23000 | High | 7.3 | 2022-07-25 | The Western Digital My Cloud Web App [https://os5.mycloud.com/] uses a weak SSLContext when attempting to configure port forwarding rules. This was enabled to… |
CVE-2022-22999 | High | 8.2 | 2022-07-25 | Western Digital My Cloud devices are vulnerable to a cross side scripting vulnerability that can allow a malicious user with elevated privileges access to driv… |
CVE-2022-22998 | High | 8.0 | 2022-07-12 | Implemented protections on AWS credentials that were not properly protected. |
CVE-2022-22997 | Medium | 6.8 | 2022-07-12 | Addressed a remote code execution vulnerability by resolving a command injection vulnerability and closing an AWS S3 bucket that potentially allowed an attacke… |
CVE-2022-22996 | High | 7.8 | 2022-03-30 | The G-RAID 4/8 Software Utility setups for Windows were affected by a DLL hijacking vulnerability. Successful exploitation could lead to arbitrary code executi… |
CVE-2022-22995 | Critical | 10.0 | 2022-03-25 | The combination of primitives offered by SMB and AFP in their default configuration allows the arbitrary writing of files. By exploiting these combination of p… |
CVE-2022-22994 | High | 8.8 | 2022-01-28 | A remote code execution vulnerability was discovered on Western Digital My Cloud devices where an attacker could trick a NAS device into loading through an uns… |
CVE-2022-22993 | High | 7.8 | 2022-01-28 | A limited SSRF vulnerability was discovered on Western Digital My Cloud devices that could allow an attacker to impersonate a server and reach any page on the… |
CVE-2022-22992 | High | 7.8 | 2022-01-28 | A command injection remote code execution vulnerability was discovered on Western Digital My Cloud Devices that could allow an attacker to execute arbitrary sy… |
CVE-2022-22991 | High | 7.8 | 2022-01-13 | A malicious user on the same LAN could use DNS spoofing followed by a command injection attack to trick a NAS device into loading through an unsecured HTTP cal… |
CVE-2022-22990 | High | 7.8 | 2022-01-13 | A limited authentication bypass vulnerability was discovered that could allow an attacker to achieve remote code execution and escalate privileges on the My Cl… |
CVE-2022-22989 | Critical | 9.8 | 2022-01-13 | My Cloud OS 5 was vulnerable to a pre-authenticated stack overflow vulnerability on the FTP service that could be exploited by unauthenticated attackers on the… |
CVE-2022-22988 | High | 7.7 | 2022-01-13 | File and directory permissions have been corrected to prevent unintended users from modifying or accessing resources. It would be more difficult for an authent… |
CVE-2021-35941 | High | 7.5 | 2021-06-29 | Western Digital WD My Book Live (2.x and later) and WD My Book Live Duo (all versions) have an administrator API that can perform a system factory restore with… |
CVE-2021-33205 | High | 8.8 | 2021-06-11 | Western Digital EdgeRover before 0.25 has an escalation of privileges vulnerability where a low privileged user could load malicious content into directories w… |
CVE-2021-28653 | Medium | 6.5 | 2021-03-19 | The iOS and macOS apps before 1.4.1 for the Western Digital G-Technology ArmorLock NVMe SSD store keys insecurely. They choose a non-preferred storage mechanis… |
CVE-2021-3310 | High | 7.8 | 2021-03-10 | Western Digital My Cloud OS 5 devices before 5.10.122 mishandle Symbolic Link Following on SMB and AFP shares. This can lead to code execution and information… |
CVE-2020-29654 | High | 7.8 | 2020-12-12 | Western Digital Dashboard before 3.2.2.9 allows DLL Hijacking that leads to compromise of the SYSTEM account. |
CVE-2020-29563 | Critical | 9.8 | 2020-12-12 | An issue was discovered on Western Digital My Cloud OS 5 devices before 5.07.118. A NAS Admin authentication bypass vulnerability could allow an unauthenticate… |
CVE-2020-28971 | Critical | 9.8 | 2020-12-01 | An issue was discovered on Western Digital My Cloud OS 5 devices before 5.06.115. A NAS Admin authentication bypass vulnerability could allow an unauthenticate… |
CVE-2020-28970 | Critical | 9.8 | 2020-12-01 | An issue was discovered on Western Digital My Cloud OS 5 devices before 5.06.115. A NAS Admin authentication bypass vulnerability could allow an unauthenticate… |
CVE-2020-28940 | Critical | 9.8 | 2020-12-01 | On Western Digital My Cloud OS 5 devices before 5.06.115, the NAS Admin dashboard has an authentication bypass vulnerability that could allow an unauthenticate… |
CVE-2020-13799 | Medium | 6.8 | 2020-11-18 | Western Digital has identified a security vulnerability in the Replay Protected Memory Block (RPMB) protocol as specified in multiple standards for storage dev… |
CVE-2020-27744 | Critical | 9.8 | 2020-10-29 | An issue was discovered on Western Digital My Cloud NAS devices before 5.04.114. They allow remote code execution with resultant escalation of privileges. |
CVE-2020-27160 | Critical | 9.8 | 2020-10-27 | Addressed remote code execution vulnerability in AvailableApps.php that allowed escalation of privileges in Western Digital My Cloud NAS devices prior to 5.04… |
CVE-2020-27159 | Critical | 9.8 | 2020-10-27 | Addressed remote code execution vulnerability in DsdkProxy.php due to insufficient sanitization and insufficient validation of user input in Western Digital My… |
CVE-2020-27158 | Critical | 9.8 | 2020-10-27 | Addressed remote code execution vulnerability in cgi_api.php that allowed escalation of privileges in Western Digital My Cloud NAS devices prior to 5.04.114. |
CVE-2020-25765 | Critical | 9.8 | 2020-10-27 | Addressed remote code execution vulnerability in reg_device.php due to insufficient validation of user input.in Western Digital My Cloud Devices prior to 5.4.1… |
CVE-2020-12830 | Critical | 9.8 | 2020-10-27 | Addressed multiple stack buffer overflow vulnerabilities that could allow an attacker to carry out escalation of privileges through unauthorized remote code ex… |
CVE-2020-15816 | High | 8.8 | 2020-07-17 | In Western Digital WD Discovery before 4.0.251.0, a malicious application running with standard user permissions could potentially execute code in the applicat… |
CVE-2020-12427 | High | 8.8 | 2020-05-13 | The Western Digital WD Discovery application before 3.8.229 for MyCloud Home on Windows and macOS is vulnerable to CSRF, with impacts such as stealing data, mo… |
CVE-2020-10951 | Medium | 4.7 | 2020-04-15 | Western Digital My Cloud Home and ibi devices before 2.2.0 allow clickjacking on sign-in pages. |
CVE-2019-10705 | High | 7.5 | 2020-03-10 | Western Digital SanDisk X600 devices in certain configurations, a vulnerability in the access control mechanism of the drive may allow data to be decrypted wit… |
CVE-2019-11686 | Medium | 5.5 | 2020-03-10 | Western Digital SanDisk X300, X300s, X400, and X600 devices: A vulnerability in the wear-leveling algorithm of the drive may cause cryptographically sensitive… |
CVE-2019-10706 | Medium | 6.3 | 2020-03-10 | Western Digital SanDisk SanDisk X300, X300s, X400, and X600 devices: The firmware update authentication method relies on a symmetric HMAC digest. The key used… |
CVE-2020-8960 | Medium | 6.1 | 2020-02-20 | Western Digital mycloud.com before Web Version 2.2.0-134 allows XSS. |
CVE-2020-8959 | High | 7.8 | 2020-02-19 | Western Digital WesternDigitalSSDDashboardSetup.exe before 3.0.2.0 allows DLL Hijacking. |
CVE-2019-13467 | Medium | 5.9 | 2019-09-30 | Description: Western Digital SSD Dashboard before 2.5.1.0 and SanDisk SSD Dashboard before 2.5.1.0 applications are potentially vulnerable to man-in-the-middle… |
CVE-2019-13466 | High | 7.5 | 2019-09-30 | Western Digital SSD Dashboard before 2.5.1.0 and SanDisk SSD Dashboard before 2.5.1.0 have Incorrect Access Control. The “generate reports” archive is protecte… |
CVE-2019-16399 | Critical | 9.8 | 2019-09-18 | Western Digital WD My Book World through II 1.02.12 suffers from Broken Authentication, which allows an attacker to access the /admin/ directory without creden… |
CVE-2018-18472 | Critical | 9.8 | 2019-06-19 | Western Digital WD My Book Live and WD My Book Live Duo (all versions) have a root Remote Command Execution bug via shell metacharacters in the /api/1.0/rest/l… |
CVE-2019-9949 | High | 8.8 | 2019-05-23 | Western Digital My Cloud Cloud, Mirror Gen2, EX2 Ultra, EX2100, EX4100, DL2100, DL4100, PR2100 and PR4100 before firmware 2.31.183 are affected by a code execu… |
CVE-2019-9950 | Critical | 9.8 | 2019-04-24 | Western Digital My Cloud, My Cloud Mirror Gen2, My Cloud EX2 Ultra, My Cloud EX2100, My Cloud EX4100, My Cloud DL2100, My Cloud DL4100, My Cloud PR2100 and My… |
CVE-2018-7928 | Medium | 4.6 | 2018-10-09 | There is a security vulnerability which could lead to Factory Reset Protection (FRP) bypass in the MyCloud APP with the versions before 8.1.2.303 installed on… |
CVE-2018-1151 | Critical | 9.8 | 2018-06-12 | The web server on Western Digital TV Media Player 1.03.07 and TV Live Hub 3.12.13 allow unauthenticated remote attackers to execute arbitrary code or cause den… |
CVE-2018-9148 | Critical | 9.8 | 2018-03-30 | Western Digital WD My Cloud v04.05.00-320 devices embed the session token (aka PHPSESSID) in filenames, which makes it easier for attackers to bypass authentic… |
CVE-2017-17560 | Critical | 9.8 | 2017-12-12 | An issue was discovered on Western Digital MyCloud PR4100 2.30.172 devices. The web administration component, /web/jquery/uploader/multi_uploadify.php, provide… |
CVE-2014-5876 | | 2014-09-11 | The WD My Cloud (aka com.wdc.wd2go) application 4.0.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers… | |
CVE-2014-2846 | | 2014-04-28 | Directory traversal vulnerability in opt/arkeia/wui/htdocs/index.php in the WD Arkeia virtual appliance (AVA) with firmware before 10.2.9 allows remote attacke… | |
CVE-2013-5006 | | 2013-07-31 | main_internet.php on the Western Digital My Net N600 and N750 with firmware 1.03.12 and 1.04.16, and the N900 and N900C with firmware 1.05.12, 1.06.18, and 1.0… |