Read the docs
TI-2022-16673 Aliases CVE-2022-36326GHSA-mc85-9rqh-47wr

Resource Exhaustion Vulnerability in Western Digital devices

Priority LOW 23CWE-400Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-400.

Summary

An uncontrolled resource consumption vulnerability issue that could arise by sending crafted requests to a service to consume a large amount of memory, eventually resulting in the service being stopped and restarted was discovered in Western Digital My Cloud Home, My Cloud Home Duo, SanDisk ibi and Western Digital My Cloud OS 5 devices. This issue requires the attacker to already have root privileges in order to exploit this vulnerability.This issue affects My Cloud Home and My Cloud Home Duo: before 9.4.0-191; ibi: before 9.4.0-191; My Cloud OS 5: before 5.26.202.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00572 47th percentileScored 2026-11-07
Fix Fixed My Cloud Home and My Cloud Home Duo (Western Digital): 9.4.0-191ibi (SanDisk): 9.4.0-191+1 more product

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Western DigitalMy Cloud Home and My Cloud Home Duobefore 9.4.0-191 9.4.0-191Patch availableCNA
SanDiskibibefore 9.4.0-191 9.4.0-191Patch availableCNA
Western DigitalMy Cloud OS 5before 5.26.2025.26.202Patch availableCNA
  • My Cloud Home and My Cloud Home Duo VendorWestern Digital Affected before 9.4.0-191 Fixed in 9.4.0-191 Patch available CNA
  • ibi VendorSanDisk Affected before 9.4.0-191 Fixed in 9.4.0-191 Patch available CNA
  • My Cloud OS 5 VendorWestern Digital Affected before 5.26.202 Fixed in 5.26.202 Patch available CNA

CPE configurations NVD · 17

CPEVersionsRoleVendor
cpe:2.3:o:westerndigital:my_cloud_os_5:*:*:*:*:*:*:*:*before 5.26.202VulnerableWesterndigital
cpe:2.3:h:westerndigital:my_cloud:-:*:*:*:*:*:*:*not specified by NVDRunning onWesterndigital
cpe:2.3:h:westerndigital:my_cloud_dl2100:-:*:*:*:*:*:*:*not specified by NVDRunning onWesterndigital
cpe:2.3:h:westerndigital:my_cloud_dl4100:-:*:*:*:*:*:*:*not specified by NVDRunning onWesterndigital
cpe:2.3:h:westerndigital:my_cloud_ex2_ultra:-:*:*:*:*:*:*:*not specified by NVDRunning onWesterndigital
cpe:2.3:h:westerndigital:my_cloud_ex2100:-:*:*:*:*:*:*:*not specified by NVDRunning onWesterndigital
cpe:2.3:h:westerndigital:my_cloud_ex4100:-:*:*:*:*:*:*:*not specified by NVDRunning onWesterndigital
cpe:2.3:h:westerndigital:my_cloud_mirror_g2:-:*:*:*:*:*:*:*not specified by NVDRunning onWesterndigital
cpe:2.3:h:westerndigital:my_cloud_pr2100:-:*:*:*:*:*:*:*not specified by NVDRunning onWesterndigital
cpe:2.3:h:westerndigital:my_cloud_pr4100:-:*:*:*:*:*:*:*not specified by NVDRunning onWesterndigital
  • cpe:2.3:o:westerndigital:my_cloud_os_5:*:*:*:*:*:*:*:* Versions before 5.26.202 Vulnerable ·Westerndigital
  • cpe:2.3:h:westerndigital:my_cloud:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Westerndigital
  • cpe:2.3:h:westerndigital:my_cloud_dl2100:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Westerndigital
  • cpe:2.3:h:westerndigital:my_cloud_dl4100:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Westerndigital
  • cpe:2.3:h:westerndigital:my_cloud_ex2_ultra:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Westerndigital
  • cpe:2.3:h:westerndigital:my_cloud_ex2100:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Westerndigital
  • cpe:2.3:h:westerndigital:my_cloud_ex4100:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Westerndigital
  • cpe:2.3:h:westerndigital:my_cloud_mirror_g2:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Westerndigital
  • cpe:2.3:h:westerndigital:my_cloud_pr2100:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Westerndigital
  • cpe:2.3:h:westerndigital:my_cloud_pr4100:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Westerndigital
Show 7 more CPE
CPEVersionsRoleVendor
cpe:2.3:h:westerndigital:wd_cloud:-:*:*:*:*:*:*:*not specified by NVDRunning onWesterndigital
cpe:2.3:o:westerndigital:my_cloud_home_firmware:*:*:*:*:*:*:*:*before 9.4.0-191VulnerableWesterndigital
cpe:2.3:h:westerndigital:my_cloud_home:-:*:*:*:*:*:*:*not specified by NVDRunning onWesterndigital
cpe:2.3:o:westerndigital:sandisk_ibi_firmware:*:*:*:*:*:*:*:*before 9.4.0-191VulnerableWesterndigital
cpe:2.3:h:westerndigital:sandisk_ibi:-:*:*:*:*:*:*:*not specified by NVDRunning onWesterndigital
cpe:2.3:o:westerndigital:my_cloud_home_duo_firmware:*:*:*:*:*:*:*:*before 9.4.0-191VulnerableWesterndigital
cpe:2.3:h:westerndigital:my_cloud_home_duo:-:*:*:*:*:*:*:*not specified by NVDRunning onWesterndigital
  • cpe:2.3:h:westerndigital:wd_cloud:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Westerndigital
  • cpe:2.3:o:westerndigital:my_cloud_home_firmware:*:*:*:*:*:*:*:* Versions before 9.4.0-191 Vulnerable ·Westerndigital
  • cpe:2.3:h:westerndigital:my_cloud_home:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Westerndigital
  • cpe:2.3:o:westerndigital:sandisk_ibi_firmware:*:*:*:*:*:*:*:* Versions before 9.4.0-191 Vulnerable ·Westerndigital
  • cpe:2.3:h:westerndigital:sandisk_ibi:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Westerndigital
  • cpe:2.3:o:westerndigital:my_cloud_home_duo_firmware:*:*:*:*:*:*:*:* Versions before 9.4.0-191 Vulnerable ·Westerndigital
  • cpe:2.3:h:westerndigital:my_cloud_home_duo:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Westerndigital

Remediation

  • Fix · CNA My Cloud Home and My Cloud Home Duo (Western Digital) Fixed in 9.4.0-191
  • Fix · CNA ibi (SanDisk) Fixed in 9.4.0-191
  • Fix · CNA My Cloud OS 5 (Western Digital) Fixed in 5.26.202

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    SanDisk ibi 9.4.0-191

    3 records Highest priority Priority MEDIUM 1 MEDIUM, 2 LOW

    Other records, highest priority first

    • TI-2022-16674 Path traversal vulnerability leading to an arbitrary file write in Western Digital devicesPriority MEDIUM 45
    • TI-2022-16675 Path Traversal Vulnerability leading to an arbitrary file read in Western Digital devicesPriority LOW 27
    Show all 3 records →
  • Release ·

    Western Digital My Cloud Home and My Cloud Home Duo, My Cloud OS 5 5.26.202, 9.4.0-191

    3 records Highest priority Priority MEDIUM 1 MEDIUM, 2 LOW

    Other records, highest priority first

    • TI-2022-16674 Path traversal vulnerability leading to an arbitrary file write in Western Digital devicesPriority MEDIUM 45
    • TI-2022-16675 Path Traversal Vulnerability leading to an arbitrary file read in Western Digital devicesPriority LOW 27
    Show all 3 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-36326
  2. 2026-10-03 Alias added: GHSA-mc85-9rqh-47wr

References

Advisory 2

  • TI-2016-08187 Unauthenticated Remote Command injection as root occurs in the Western Digital MyCloud… CVSS 3.0CRITICAL 9.8
  • TI-2018-12259 It was discovered that the Western Digital My Cloud device before 2.30.196 is affected by… CVSS 3.0CRITICAL 9.8
  • TI-2022-12204 Western Digital My Cloud OS 5 arbitrary file read and write vulnerability via ftp CVSS 3.1CRITICAL 9.8
  • TI-2016-08186 Unauthenticated Remote Command injection as root occurs in the Western Digital MyCloud… CVSS 3.0CRITICAL 9.8
  • TI-2018-01067 Memory corruption in Western Digital TV Media Player CVSS 3.0CRITICAL 9.8
  • TI-2022-12202 Command Injection Vulnerability in Western Digital My Cloud devices CVSS 3.1CRITICAL 9.8
See all 52 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences