Read the docs
TI-2022-07176 Aliases CVE-2022-23001

Sweet-B Library: Point compress/decompress using the wrong bit for sign

Priority LOW 25CWE-682Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · None · Low
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

When compressing or decompressing elliptic curve points using the Sweet B library, an incorrect choice of sign bit is used. An attacker with user level privileges and no other user's assistance can exploit this vulnerability with only knowledge of the public key and the library. The resulting output may cause an error when used in other operations; for instance, verification of a valid signature under a decompressed public key may fail. This may be leveraged by an attacker to cause an error scenario in applications which use the library, resulting in a limited denial of service for an individual user. The scope of impact cannot extend to other components.

Why it matters now

EPSS 0.0072 54th percentileScored 2026-11-07
Fix Fixed Sweet B Library (Western Digital): v2

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
Western DigitalSweet B LibrarySweet B Library to before v2v2Patch availableCNA
  • Sweet B Library VendorWestern Digital Affected Sweet B Library to before v2 Fixed in v2 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:westerndigital:sweet_b:1:*:*:*:*:*:*:*1VulnerableWesterndigital
  • cpe:2.3:a:westerndigital:sweet_b:1:*:*:*:*:*:*:* Versions 1 Vulnerable ·Westerndigital

Remediation

  • Fix · CNA Sweet B Library (Western Digital) Fixed in v2

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Western Digital Sweet B Library v2

    4 records Highest priority Priority LOW 4 LOW

    Other records, highest priority first

    • TI-2022-07179 Algorithm incorrectly returning error and Invalid unreduced value written to output bufferPriority LOW 25
    • TI-2022-07178 Shared secret or Point multiplication of NIST P-256 points with X coordinate of zeroPriority LOW 25
    • TI-2022-07177 Point Compression/Decompression of NIST P-256 points with X coordinate of zeroPriority LOW 25
    Show all 4 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-23001

References

Advisory 1

  • TI-2016-08187 Unauthenticated Remote Command injection as root occurs in the Western Digital MyCloud… CVSS 3.0CRITICAL 9.8
  • TI-2018-12259 It was discovered that the Western Digital My Cloud device before 2.30.196 is affected by… CVSS 3.0CRITICAL 9.8
  • TI-2022-12204 Western Digital My Cloud OS 5 arbitrary file read and write vulnerability via ftp CVSS 3.1CRITICAL 9.8
  • TI-2016-08186 Unauthenticated Remote Command injection as root occurs in the Western Digital MyCloud… CVSS 3.0CRITICAL 9.8
  • TI-2018-01067 Memory corruption in Western Digital TV Media Player CVSS 3.0CRITICAL 9.8
  • TI-2022-12202 Command Injection Vulnerability in Western Digital My Cloud devices CVSS 3.1CRITICAL 9.8
See all 52 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences