Cross-Site Scripting (XSS) vulnerability on Western Digital My Cloud and SanDisk ibi Web Apps
Priority LOW 26CWE-79Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Active
- Attack complexity
- High
- Attack requirements
- None
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- None · High · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-79.
Summary
A Cross-Site Scripting (XSS) vulnerability on the My Cloud, My Cloud Home, SanDisk ibi, and WD Cloud web apps was found which could allow an attacker to redirect the user to a crafted domain and reset their credentials, or to execute arbitrary client-side code in the user’s browser session to carry out malicious activities.The web apps for these devices have been automatically updated to resolve this vulnerability and improve the security of your devices and data.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00324 25th percentileScored 2026-11-07
Fix Fixed My Cloud Home web app (Western Digital): 4.28.0-102ibi web app (SanDisk): 4.28.0-102+2 more products
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Western Digital | My Cloud Home web app | before 4.28.0-102 | 4.28.0-102 | Patch available | CNA |
| SanDisk | ibi web app | before 4.28.0-102 | 4.28.0-102 | Patch available | CNA |
| Western Digital | WD Cloud web app | before 4.28.0-102 | 4.28.0-102 | Patch available | CNA |
| Western Digital | My Cloud web app | before 4.28.0-102 | 4.28.0-102 | Patch available | CNA |
- My Cloud Home web app VendorWestern Digital Affected before 4.28.0-102 Fixed in 4.28.0-102 Patch available CNA
- ibi web app VendorSanDisk Affected before 4.28.0-102 Fixed in 4.28.0-102 Patch available CNA
- WD Cloud web app VendorWestern Digital Affected before 4.28.0-102 Fixed in 4.28.0-102 Patch available CNA
- My Cloud web app VendorWestern Digital Affected before 4.28.0-102 Fixed in 4.28.0-102 Patch available CNA
CPE names CISA-ADP · 4
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:western_digital:my_cloud_home_web_app:*:*:*:*:*:*:*:* | — | — | Western Digital |
| cpe:2.3:a:sandisk:ibi_web_app:*:*:*:*:*:*:*:* | — | — | SanDisk |
| cpe:2.3:a:western_digital:wd_cloud_web_app:*:*:*:*:*:*:*:* | — | — | Western Digital |
| cpe:2.3:a:western_digital:my_cloud_web_app:*:*:*:*:*:*:*:* | — | — | Western Digital |
- cpe:2.3:a:western_digital:my_cloud_home_web_app:*:*:*:*:*:*:*:* Versions — — ·Western Digital
- cpe:2.3:a:sandisk:ibi_web_app:*:*:*:*:*:*:*:* Versions — — ·SanDisk
- cpe:2.3:a:western_digital:wd_cloud_web_app:*:*:*:*:*:*:*:* Versions — — ·Western Digital
- cpe:2.3:a:western_digital:my_cloud_web_app:*:*:*:*:*:*:*:* Versions — — ·Western Digital
Remediation
- Fix · CNA My Cloud Home web app (Western Digital) Fixed in 4.28.0-102
- Fix · CNA ibi web app (SanDisk) Fixed in 4.28.0-102
- Fix · CNA WD Cloud web app (Western Digital) Fixed in 4.28.0-102
- Fix · CNA My Cloud web app (Western Digital) Fixed in 4.28.0-102
Timeline
- 2026-10-02 Threatist record created from CVE-2024-22168
- 2026-10-03 Alias added: GHSA-g8r2-4q75-c55g
References
More Western Digital vulnerabilities
- TI-2016-08187 Unauthenticated Remote Command injection as root occurs in the Western Digital MyCloud… CVSS 3.0CRITICAL 9.8
- TI-2018-12259 It was discovered that the Western Digital My Cloud device before 2.30.196 is affected by… CVSS 3.0CRITICAL 9.8
- TI-2022-12204 Western Digital My Cloud OS 5 arbitrary file read and write vulnerability via ftp CVSS 3.1CRITICAL 9.8
- TI-2016-08186 Unauthenticated Remote Command injection as root occurs in the Western Digital MyCloud… CVSS 3.0CRITICAL 9.8
- TI-2018-01067 Memory corruption in Western Digital TV Media Player CVSS 3.0CRITICAL 9.8
- TI-2022-12202 Command Injection Vulnerability in Western Digital My Cloud devices CVSS 3.1CRITICAL 9.8
Sources
- CVE-2024-22168 · CVE Program
- CVE-2024-22168 · NVD
- FIRST EPSS
- GHSA-g8r2-4q75-c55g · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences