Read the docs
TI-2022-16675 Aliases CVE-2022-36328GHSA-5445-wchw-r2mr

Path Traversal Vulnerability leading to an arbitrary file read in Western Digital devices

Priority LOW 27CWE-22Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
High
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-22 and the CVSS impact.

Summary

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could allow an attacker to create arbitrary shares on arbitrary directories and exfiltrate sensitive files, passwords, users and device configurations was discovered in Western Digital My Cloud Home, My Cloud Home Duo, SanDisk ibi and Western Digital My Cloud OS 5 devices. This can only be exploited once an attacker gains root privileges on the devices using an authentication bypass issue or another vulnerability.This issue affects My Cloud Home and My Cloud Home Duo: before 9.4.0-191; ibi: before 9.4.0-191; My Cloud OS 5: before 5.26.202.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00767 55th percentileScored 2026-11-07
Fix Fixed My Cloud Home and My Cloud Home Duo (Western Digital): 9.4.0-191ibi (SanDisk): 9.4.0-191+1 more product

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Western DigitalMy Cloud Home and My Cloud Home Duobefore 9.4.0-1919.4.0-191Patch availableCNA
SanDiskibibefore 9.4.0-1919.4.0-191Patch availableCNA
Western DigitalMy Cloud OS 5before 5.26.2025.26.202Patch availableCNA
  • My Cloud Home and My Cloud Home Duo VendorWestern Digital Affected before 9.4.0-191 Fixed in 9.4.0-191 Patch available CNA
  • ibi VendorSanDisk Affected before 9.4.0-191 Fixed in 9.4.0-191 Patch available CNA
  • My Cloud OS 5 VendorWestern Digital Affected before 5.26.202 Fixed in 5.26.202 Patch available CNA

CPE configurations NVD · 17

CPEVersionsRoleVendor
cpe:2.3:o:westerndigital:my_cloud_os_5:*:*:*:*:*:*:*:*before 5.26.202VulnerableWesterndigital
cpe:2.3:h:westerndigital:my_cloud:-:*:*:*:*:*:*:*not specified by NVDRunning onWesterndigital
cpe:2.3:h:westerndigital:my_cloud_dl2100:-:*:*:*:*:*:*:*not specified by NVDRunning onWesterndigital
cpe:2.3:h:westerndigital:my_cloud_dl4100:-:*:*:*:*:*:*:*not specified by NVDRunning onWesterndigital
cpe:2.3:h:westerndigital:my_cloud_ex2_ultra:-:*:*:*:*:*:*:*not specified by NVDRunning onWesterndigital
cpe:2.3:h:westerndigital:my_cloud_ex2100:-:*:*:*:*:*:*:*not specified by NVDRunning onWesterndigital
cpe:2.3:h:westerndigital:my_cloud_ex4100:-:*:*:*:*:*:*:*not specified by NVDRunning onWesterndigital
cpe:2.3:h:westerndigital:my_cloud_mirror_g2:-:*:*:*:*:*:*:*not specified by NVDRunning onWesterndigital
cpe:2.3:h:westerndigital:my_cloud_pr2100:-:*:*:*:*:*:*:*not specified by NVDRunning onWesterndigital
cpe:2.3:h:westerndigital:my_cloud_pr4100:-:*:*:*:*:*:*:*not specified by NVDRunning onWesterndigital
  • cpe:2.3:o:westerndigital:my_cloud_os_5:*:*:*:*:*:*:*:* Versions before 5.26.202 Vulnerable ·Westerndigital
  • cpe:2.3:h:westerndigital:my_cloud:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Westerndigital
  • cpe:2.3:h:westerndigital:my_cloud_dl2100:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Westerndigital
  • cpe:2.3:h:westerndigital:my_cloud_dl4100:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Westerndigital
  • cpe:2.3:h:westerndigital:my_cloud_ex2_ultra:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Westerndigital
  • cpe:2.3:h:westerndigital:my_cloud_ex2100:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Westerndigital
  • cpe:2.3:h:westerndigital:my_cloud_ex4100:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Westerndigital
  • cpe:2.3:h:westerndigital:my_cloud_mirror_g2:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Westerndigital
  • cpe:2.3:h:westerndigital:my_cloud_pr2100:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Westerndigital
  • cpe:2.3:h:westerndigital:my_cloud_pr4100:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Westerndigital
Show 7 more CPE
CPEVersionsRoleVendor
cpe:2.3:h:westerndigital:wd_cloud:-:*:*:*:*:*:*:*not specified by NVDRunning onWesterndigital
cpe:2.3:o:westerndigital:my_cloud_home_firmware:*:*:*:*:*:*:*:*before 9.4.0-191VulnerableWesterndigital
cpe:2.3:h:westerndigital:my_cloud_home:-:*:*:*:*:*:*:*not specified by NVDRunning onWesterndigital
cpe:2.3:o:westerndigital:sandisk_ibi_firmware:*:*:*:*:*:*:*:*before 9.4.0-191VulnerableWesterndigital
cpe:2.3:h:westerndigital:sandisk_ibi:-:*:*:*:*:*:*:*not specified by NVDRunning onWesterndigital
cpe:2.3:o:westerndigital:my_cloud_home_duo_firmware:*:*:*:*:*:*:*:*before 9.4.0-191VulnerableWesterndigital
cpe:2.3:h:westerndigital:my_cloud_home_duo:-:*:*:*:*:*:*:*not specified by NVDRunning onWesterndigital
  • cpe:2.3:h:westerndigital:wd_cloud:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Westerndigital
  • cpe:2.3:o:westerndigital:my_cloud_home_firmware:*:*:*:*:*:*:*:* Versions before 9.4.0-191 Vulnerable ·Westerndigital
  • cpe:2.3:h:westerndigital:my_cloud_home:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Westerndigital
  • cpe:2.3:o:westerndigital:sandisk_ibi_firmware:*:*:*:*:*:*:*:* Versions before 9.4.0-191 Vulnerable ·Westerndigital
  • cpe:2.3:h:westerndigital:sandisk_ibi:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Westerndigital
  • cpe:2.3:o:westerndigital:my_cloud_home_duo_firmware:*:*:*:*:*:*:*:* Versions before 9.4.0-191 Vulnerable ·Westerndigital
  • cpe:2.3:h:westerndigital:my_cloud_home_duo:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Westerndigital

Remediation

  • Fix · CNA My Cloud Home and My Cloud Home Duo (Western Digital) Fixed in 9.4.0-191
  • Fix · CNA ibi (SanDisk) Fixed in 9.4.0-191
  • Fix · CNA My Cloud OS 5 (Western Digital) Fixed in 5.26.202

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    SanDisk ibi 9.4.0-191

    3 records Highest priority Priority MEDIUM 1 MEDIUM, 2 LOW

    Other records, highest priority first

    • TI-2022-16674 Path traversal vulnerability leading to an arbitrary file write in Western Digital devicesPriority MEDIUM 45
    • TI-2022-16673 Resource Exhaustion Vulnerability in Western Digital devicesPriority LOW 23
    Show all 3 records →
  • Release ·

    Western Digital My Cloud Home and My Cloud Home Duo, My Cloud OS 5 5.26.202, 9.4.0-191

    3 records Highest priority Priority MEDIUM 1 MEDIUM, 2 LOW

    Other records, highest priority first

    • TI-2022-16674 Path traversal vulnerability leading to an arbitrary file write in Western Digital devicesPriority MEDIUM 45
    • TI-2022-16673 Resource Exhaustion Vulnerability in Western Digital devicesPriority LOW 23
    Show all 3 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-36328
  2. 2026-10-03 Alias added: GHSA-5445-wchw-r2mr

References

Advisory 2

  • TI-2016-08187 Unauthenticated Remote Command injection as root occurs in the Western Digital MyCloud… CVSS 3.0CRITICAL 9.8
  • TI-2018-12259 It was discovered that the Western Digital My Cloud device before 2.30.196 is affected by… CVSS 3.0CRITICAL 9.8
  • TI-2022-12204 Western Digital My Cloud OS 5 arbitrary file read and write vulnerability via ftp CVSS 3.1CRITICAL 9.8
  • TI-2016-08186 Unauthenticated Remote Command injection as root occurs in the Western Digital MyCloud… CVSS 3.0CRITICAL 9.8
  • TI-2018-01067 Memory corruption in Western Digital TV Media Player CVSS 3.0CRITICAL 9.8
  • TI-2022-12202 Command Injection Vulnerability in Western Digital My Cloud devices CVSS 3.1CRITICAL 9.8
See all 52 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences