Buffer Overflow Vulnerability in Western Digital My Cloud Home and ibi devices
Priority LOW 36CWE-120Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- High
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-120 and the CVSS impact.
Summary
A buffer overflow vulnerability was discovered on firmware version validation that could lead to an unauthenticated remote code execution in Western Digital My Cloud Home, My Cloud Home Duo and SanDisk ibi devices. An attacker would require exploitation of another vulnerability to raise their privileges in order to exploit this buffer overflow vulnerability. This issue affects My Cloud Home and My Cloud Home Duo: before 9.4.0-191; ibi: before 9.4.0-191.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00557 46th percentileScored 2026-11-07
Fix Fixed My Cloud Home and My Cloud Home Duo (Western Digital): 9.4.0-191ibi (SanDisk): 9.4.0-191
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Western Digital | My Cloud Home and My Cloud Home Duo | before 9.4.0-191 | 9.4.0-191 | Patch available | CNA |
| SanDisk | ibi | before 9.4.0-191 | 9.4.0-191 | Patch available | CNA |
- My Cloud Home and My Cloud Home Duo VendorWestern Digital Affected before 9.4.0-191 Fixed in 9.4.0-191 Patch available CNA
- ibi VendorSanDisk Affected before 9.4.0-191 Fixed in 9.4.0-191 Patch available CNA
CPE configurations NVD · 6
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:westerndigital:my_cloud_home_duo_firmware:*:*:*:*:*:*:*:* | before 9.4.0-191 | Vulnerable | Westerndigital |
| cpe:2.3:h:westerndigital:my_cloud_home_duo:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Westerndigital |
| cpe:2.3:o:westerndigital:sandisk_ibi_firmware:*:*:*:*:*:*:*:* | before 9.4.0-191 | Vulnerable | Westerndigital |
| cpe:2.3:h:westerndigital:sandisk_ibi:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Westerndigital |
| cpe:2.3:o:westerndigital:my_cloud_home_firmware:*:*:*:*:*:*:*:* | before 9.4.0-191 | Vulnerable | Westerndigital |
| cpe:2.3:h:westerndigital:my_cloud_home:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Westerndigital |
- cpe:2.3:o:westerndigital:my_cloud_home_duo_firmware:*:*:*:*:*:*:*:* Versions before 9.4.0-191 Vulnerable ·Westerndigital
- cpe:2.3:h:westerndigital:my_cloud_home_duo:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Westerndigital
- cpe:2.3:o:westerndigital:sandisk_ibi_firmware:*:*:*:*:*:*:*:* Versions before 9.4.0-191 Vulnerable ·Westerndigital
- cpe:2.3:h:westerndigital:sandisk_ibi:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Westerndigital
- cpe:2.3:o:westerndigital:my_cloud_home_firmware:*:*:*:*:*:*:*:* Versions before 9.4.0-191 Vulnerable ·Westerndigital
- cpe:2.3:h:westerndigital:my_cloud_home:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Westerndigital
Remediation
- Fix · CNA My Cloud Home and My Cloud Home Duo (Western Digital) Fixed in 9.4.0-191
- Fix · CNA ibi (SanDisk) Fixed in 9.4.0-191
Timeline
- 2026-10-02 Threatist record created from CVE-2022-36330
- 2026-10-03 Alias added: GHSA-gvrx-2pqj-7jjm
References
More Western Digital vulnerabilities
- TI-2016-08187 Unauthenticated Remote Command injection as root occurs in the Western Digital MyCloud… CVSS 3.0CRITICAL 9.8
- TI-2018-12259 It was discovered that the Western Digital My Cloud device before 2.30.196 is affected by… CVSS 3.0CRITICAL 9.8
- TI-2022-12204 Western Digital My Cloud OS 5 arbitrary file read and write vulnerability via ftp CVSS 3.1CRITICAL 9.8
- TI-2016-08186 Unauthenticated Remote Command injection as root occurs in the Western Digital MyCloud… CVSS 3.0CRITICAL 9.8
- TI-2018-01067 Memory corruption in Western Digital TV Media Player CVSS 3.0CRITICAL 9.8
- TI-2022-12202 Command Injection Vulnerability in Western Digital My Cloud devices CVSS 3.1CRITICAL 9.8
Sources
- CVE-2022-36330 · CVE Program
- CVE-2022-36330 · NVD
- FIRST EPSS
- GHSA-gvrx-2pqj-7jjm · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences