ID
VAR-202209-1975
CVE
CVE-2022-23006
TITLE
plural Western Digital Out-of-bounds write vulnerabilities in the product
Trust: 0.8
DESCRIPTION
A stack-based buffer overflow vulnerability was found on Western Digital My Cloud Home, My Cloud Home Duo, and SanDisk ibi that could allow an attacker accessing the system locally to read information from /etc/version file. This vulnerability can only be exploited by chaining it with another issue. If an attacker is able to carry out a remote code execution attack, they can gain access to the vulnerable file, due to the presence of insecure functions in code. User interaction is required for exploitation. Exploiting the vulnerability could result in exposure of information, ability to modify files, memory access errors, or system crashes. (DoS) It may be in a state. Western Digital My Cloud, etc. are all products of Western Digital (Western Digital). Western Digital My Cloud is a personal cloud storage device. Western Digital My Cloud Home is an easy-to-use personal cloud storage device. SanDisk ibi and so on are all products of SanDisk Corporation of the United States. SanDisk ibi is an intelligent photo organizer and media storage hard drive. There is a buffer overflow vulnerability in Western Digital products. Attackers can use this vulnerability to access the system locally and read the /etc/version file
Trust: 2.25
IOT TAXONOMY
| category: | ['IoT'] | sub_category: | - | Trust: 0.6 |
AFFECTED PRODUCTS
| vendor: | westerndigital | model: | my cloud home | scope: | lt | version: | 8.10.0-117 | Trust: 1.0 |
| vendor: | westerndigital | model: | sandisk ibi | scope: | lt | version: | 8.10.0-117 | Trust: 1.0 |
| vendor: | westerndigital | model: | my cloud home duo | scope: | lt | version: | 8.10.0-117 | Trust: 1.0 |
| vendor: | western digital | model: | my cloud home duo | scope: | - | version: | - | Trust: 0.8 |
| vendor: | western digital | model: | sandisk ibi | scope: | - | version: | - | Trust: 0.8 |
| vendor: | western digital | model: | my cloud home | scope: | - | version: | - | Trust: 0.8 |
| vendor: | western | model: | digital my cloud home | scope: | lt | version: | 8.10.0-117 | Trust: 0.6 |
| vendor: | western | model: | digital my cloud home duo | scope: | lt | version: | 8.10.0-117 | Trust: 0.6 |
| vendor: | western | model: | digital sandisk ibi | scope: | lt | version: | 8.10.0-117 | Trust: 0.6 |
CVSS
SEVERITY | CVSSV2 | CVSSV3 | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
|
|
PROBLEMTYPE DATA
| problemtype: | CWE-121 | Trust: 1.0 |
| problemtype: | CWE-787 | Trust: 1.0 |
| problemtype: | Out-of-bounds writing (CWE-787) [NVD evaluation ] | Trust: 0.8 |
THREAT TYPE
local
Trust: 0.6
TYPE
buffer error
Trust: 0.6
EXTERNAL IDS
| db: | NVD | id: | CVE-2022-23006 | Trust: 3.9 |
| db: | JVNDB | id: | JVNDB-2022-018157 | Trust: 0.8 |
| db: | CNVD | id: | CNVD-2022-88804 | Trust: 0.6 |
| db: | CNNVD | id: | CNNVD-202209-2808 | Trust: 0.6 |
| db: | VULMON | id: | CVE-2022-23006 | Trust: 0.1 |
REFERENCES
| url: | https://nvd.nist.gov/vuln/detail/cve-2022-23006 | Trust: 3.9 |
| url: | https://www.westerndigital.com/support/product-security/wdc-22015-western-digital-my-cloud-home-and-sandisk-ibi-firmware-version-8-10-0-117 | Trust: 2.4 |
| url: | https://cxsecurity.com/cveshow/cve-2022-23006/ | Trust: 0.6 |
| url: | https://nvd.nist.gov | Trust: 0.1 |
SOURCES
| db: | CNVD | id: | CNVD-2022-88804 |
| db: | VULMON | id: | CVE-2022-23006 |
| db: | JVNDB | id: | JVNDB-2022-018157 |
| db: | CNNVD | id: | CNNVD-202209-2808 |
| db: | NVD | id: | CVE-2022-23006 |
LAST UPDATE DATE
2024-08-14T14:17:41.799000+00:00
SOURCES UPDATE DATE
| db: | CNVD | id: | CNVD-2022-88804 | date: | 2022-12-20T00:00:00 |
| db: | VULMON | id: | CVE-2022-23006 | date: | 2022-09-28T00:00:00 |
| db: | JVNDB | id: | JVNDB-2022-018157 | date: | 2023-10-18T08:12:00 |
| db: | CNNVD | id: | CNNVD-202209-2808 | date: | 2022-10-08T00:00:00 |
| db: | NVD | id: | CVE-2022-23006 | date: | 2022-10-03T18:40:17.377 |
SOURCES RELEASE DATE
| db: | CNVD | id: | CNVD-2022-88804 | date: | 2022-12-16T00:00:00 |
| db: | VULMON | id: | CVE-2022-23006 | date: | 2022-09-27T00:00:00 |
| db: | JVNDB | id: | JVNDB-2022-018157 | date: | 2023-10-18T00:00:00 |
| db: | CNNVD | id: | CNNVD-202209-2808 | date: | 2022-09-27T00:00:00 |
| db: | NVD | id: | CVE-2022-23006 | date: | 2022-09-27T23:15:12.720 |