WDC PSIRT

Latest CVEs · RSS

• CVE-2025-30248 2026-01-26 · CVSS 8.9
  DLL hijacking in the WD Discovery Installer in Western Digital WD Discovery 5.2.730 on Windows allows a local attacker to execute arbitrary code via placement o
• CVE-2025-30247 2025-09-29 · CVSS 9.3
  An OS command injection vulnerability in user interface in Western Digital My Cloud firmware prior to 5.31.108 on NAS platforms allows remote attackers to execu
• CVE-2024-22170 2024-09-27 · CVSS 9.2
  Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in Western Digital My Cloud ddns-start on Linux allows Overflow Buffers.Th
• CVE-2024-22169 2024-08-02 · CVSS 7.1
  WD Discovery versions prior to 5.0.589 contain a misconfiguration in the Node.js environment settings that could allow code execution by utilizing the 'ELECTRON
• CVE-2024-22168 2024-06-24 · CVSS 5.9
  A Cross-Site Scripting (XSS) vulnerability on the My Cloud, My Cloud Home, SanDisk ibi, and WD Cloud web apps was found which could allow an attacker to redirec
• CVE-2024-22167 2024-03-13 · CVSS 7.9
  A potential DLL hijacking vulnerability in the SanDisk PrivateAccess application for Windows that could lead to arbitrary code execution in the context of the s
• CVE-2023-22819 2024-02-05 · CVSS 4.9
  An uncontrolled resource consumption vulnerability issue that could arise by sending crafted requests to a service to consume a large amount of memory, eventual
• CVE-2023-22817 2024-02-05 · CVSS 5.5
  Server-side request forgery (SSRF) vulnerability that could allow a rogue server on the local network to modify its URL using another DNS address to point back
• CVE-2023-22818 2023-11-15 · CVSS 7.3
  Multiple DLL Search Order Hijack vulnerabilities were addressed in the SanDisk Security Installer for Windows that could allow attackers with local access to ex
• CVE-2023-22814 2023-06-30 · CVSS 10.0
  An authentication bypass issue via spoofing was discovered in the token-based authentication mechanism that could allow an attacker to carry out an impersonatio
• CVE-2023-22815 2023-06-30 · CVSS 6.2
  Post-authentication remote command injection vulnerability in Western Digital My Cloud OS 5 devices that could allow an attacker to execute code in the context
• CVE-2023-22816 2023-06-30 · CVSS 6.0
  A post-authentication remote command injection vulnerability in a CGI file in Western Digital My Cloud OS 5 devices that could allow an attacker to build files
• CVE-2022-36331 2023-06-12 · CVSS 10.0
  Western Digital My Cloud, My Cloud Home, My Cloud Home Duo, and SanDisk ibi devices were vulnerable to an impersonation attack that could allow an unauthenticat
• CVE-2022-36328 2023-05-18 · CVSS 5.8
  Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could allow an attacker to create arbitrary shares on arbitrar
• CVE-2022-36327 2023-05-18 · CVSS 5.8
  Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could allow an attacker to write files to locations with certa
• CVE-2022-36326 2023-05-18 · CVSS 4.4
  An uncontrolled resource consumption vulnerability issue that could arise by sending crafted requests to a service to consume a large amount of memory, eventual
• CVE-2022-29840 2023-05-10 · CVSS 5.1
  Server-Side Request Forgery (SSRF) vulnerability that could allow a rogue server on the local network to modify its URL to point back to the loopback adapter wa
• CVE-2022-29841 2023-05-10 · CVSS 8.0
  Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability that was caused by a command that read files from a pri
• CVE-2022-29842 2023-05-10 · CVSS 9.8
  Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability that could allow an attacker to execute code in the context of
• CVE-2022-36329 2023-05-10 · CVSS 4.4
  An improper privilege management issue that could allow an attacker to cause a denial of service over the OTA mechanism was discovered in Western Digital My Clo
• CVE-2022-36330 2023-05-09 · CVSS 1.9
  A buffer overflow vulnerability was discovered on firmware version validation that could lead to an unauthenticated remote code execution in Western Digital My
• CVE-2023-22813 2023-05-08 · CVSS 3.3
  A device API endpoint was missing access controls on Western Digital My Cloud OS 5 iOS and Anroid Mobile Apps, My Cloud Home iOS and Android Mobile Ap
• CVE-2023-22812 2023-03-24 · CVSS 7.4
  SanDisk PrivateAccess versions prior to 6.4.9 support insecure TLS 1.0 and TLS 1.1 protocols which are susceptible to man-in-the-middle attacks thereby compromi
• CVE-2022-29843 2023-01-25 · CVSS 6.2
  A command injection vulnerability in the DDNS service configuration of Western Digital My Cloud OS 5 devices running firmware versions prior to 5.26.119 allows
• CVE-2022-29844 2023-01-25 · CVSS 6.7
  A vulnerability in the FTP service of Western Digital My Cloud OS 5 devices running firmware versions prior to 5.26.119 allows an attacker to read and write arb