Cyber Resilience

CVE-2022-36330

Low

Published: 10 May 2023

Published
10 May 2023
Modified
21 November 2024
KEV Added
—
Patch
—
CVSS Score v3.1 1.9 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N
EPSS Score 0.0043 63.1th percentile
Risk Priority 4 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2022-36330 is a low-severity Classic Buffer Overflow (CWE-120) vulnerability in Westerndigital My Cloud Home Duo Firmware. Its CVSS base score is 1.9 (Low).

Operationally, ranked in the top 36.9% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

EU & UK References

Vulnerability details

A buffer overflow vulnerability was discovered on firmware version validation that could lead to an unauthenticated remote code execution in Western Digital My Cloud Home, My Cloud Home Duo and SanDisk ibi devices. An attacker would require exploitation of another…

more

vulnerability to raise their privileges in order to exploit this buffer overflow vulnerability. This issue affects My Cloud Home and My Cloud Home Duo: before 9.4.0-191; ibi: before 9.4.0-191.

CWE(s)
CWE-120

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

westerndigital
my cloud home duo firmware
≤ 9.4.0-191 · ≤ 9.4.0-191
westerndigital
sandisk ibi firmware
≤ 9.4.0-191
westerndigital
my cloud home firmware
≤ 9.4.0-191

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

SC-27 Platform-independent Applications
addresses: CWE-120

Platform-independent managed code eliminates the need for unchecked native buffer copies that are the root cause of classic buffer overflows.

References