CVE-2022-36326

Resource Exhaustion Vulnerability in Western Digital devices

MEDIUM

4.9

CVSS Score

Published: May 18, 2023 at 05:53 PM UTC

Updated: June 17, 2026 at 04:53 AM UTC

18 products affected across 2 vendorsMy Cloud OS 5My Cloud Home FirmwareMy Cloud Home Duo Firmware

Using My Cloud Home and My Cloud Home Duo by Western Digital?

Get instant alerts when new vulnerabilities affect My Cloud Home and My Cloud Home Duo - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

MEDIUM4.9

Exploit prediction

EPSS 0.6%

SSVC

No known exploit

Description

An uncontrolled resource consumption vulnerability issue that could arise by sending crafted requests to a service to consume a large amount of memory, eventually resulting in the service being stopped and restarted was discovered in Western Digital My Cloud Home, My Cloud Home Duo, SanDisk ibi and Western Digital My Cloud OS 5 devices. This issue requires the attacker to already have root privileges in order to exploit this vulnerability.This issue affects My Cloud Home and My Cloud Home Duo: before 9.4.0-191; ibi: before 9.4.0-191; My Cloud OS 5: before 5.26.202.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

My Cloud Home Duo Firmware · Westerndigital

95%

v < 9.4.0-191

Affected range stops below 9.4.0-191, so it looks safe — our inference, not a vendor statement

westerndigital-my-cloud-home-duo (same device)

My Cloud Home Firmware · Westerndigital

95%

v < 9.4.0-191

Affected range stops below 9.4.0-191, so it looks safe — our inference, not a vendor statement

westerndigital-my-cloud-home (same device)

My Cloud OS 5 · Westerndigital

95%

v < 5.26.202

Affected range stops below 5.26.202, so it looks safe — our inference, not a vendor statement

westerndigital-my-cloud-dl2100 (environment) · westerndigital-my-cloud-dl4100 (environment) · westerndigital-my-cloud-ex2-ultra (environment) · westerndigital-my-cloud-ex2100 (environment) · westerndigital-my-cloud-ex4100 (environment) · westerndigital-my-cloud-mirror-g2 (environment) · westerndigital-my-cloud-pr2100 (environment) · westerndigital-my-cloud-pr4100 (environment) · westerndigital-wd-cloud (environment) · westerndigital-my-cloud (same device)

Sandisk Ibi Firmware · Westerndigital

95%

v < 9.4.0-191

Affected range stops below 9.4.0-191, so it looks safe — our inference, not a vendor statement

westerndigital-sandisk-ibi (same device)

Ibi · Sandisk

60%

v < 9.4.0-191

Affected range stops below 9.4.0-191, so it looks safe — our inference, not a vendor statement

My Cloud · Westerndigitaldevice

80%

All versions