title: Path traversal Vulnerability in Western Digital My Cloud Home, My Cloud Home Duo and SanDisk ibi Devices
description: A path traversal vulnerability was addressed in Western Digital My Cloud Home, My Cloud Home Duo and SanDisk ibi which could allow an attacker to initiate installation of custom ZIP packages and overwrite system files. This could potentially lead to a code execution.
problem types: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
affected:
{
vendor: Western Digital
product: My Cloud Home
versions:
version: My Cloud Home , status: affected, lessThan: 8.12.0-178, versionType: custom
version: My Cloud Home Duo, status: affected, lessThan: 8.12.0-178, versionType: custom
platforms: Linux
}
{
vendor: SanDisk
product: ibi
versions:
version: ibi, status: affected, lessThan: 8.12.0-178, versionType: custom
platforms: Linux
}
metrics:
cvssV3_1: [
version: 3.1
vectorString: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N
attackVector: LOCAL
attackComplexity: HIGH
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: HIGH
availabilityImpact: NONE
baseScore: 4.7
baseSeverity: MEDIUM
]
solutions: The user's My Cloud Home, My Cloud Home Duo and ibi devices will be automatically updated to reflect the latest firmware version.