CVE-2022-36331

7.5 highEPSS 0.6%

Western Digital My Cloud, My Cloud Home, My Cloud Home Duo, and SanDisk ibi devices were vulnerable to an impersonation attack that could allow an unauthenticated attacker to gain access to user data. This issue affects My Cloud OS 5 devices: before 5.25.132; My Cloud Home and My Cloud Home Duo: before 8.13.1-102; SanDisk ibi: before 8.13.1-102.

Severity

CVSS 3.1

7.5 high

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS: 0.6% chance of exploitation in the next 30 days; higher than 48% of CVEs (scores of 2026-10-31)
CWE: CWE-290
Published: 2023-06-12
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

westerndigital:my_cloud_dl2100_firmware
westerndigital:my_cloud_dl4100_firmware
westerndigital:my_cloud_ex2100_firmware
westerndigital:my_cloud_ex2_ultra_firmware
westerndigital:my_cloud_ex4100_firmware
westerndigital:my_cloud_firmware
westerndigital:my_cloud_home_duo_firmware
westerndigital:my_cloud_home_firmware
westerndigital:my_cloud_mirror_g2_firmware
westerndigital:my_cloud_pr2100_firmware
westerndigital:my_cloud_pr4100_firmware
westerndigital:sandisk_ibi_firmware

References

Check your stack JSON