title: Impersonation attack causing an Authentication Bypass on Western Digital devices
description: Western Digital My Cloud, My Cloud Home, My Cloud Home Duo, and SanDisk ibi devices were vulnerable to an impersonation attack that could allow an unauthenticated attacker to gain access to user data.
This issue affects My Cloud OS 5 devices: before 5.25.132; My Cloud Home and My Cloud Home Duo: before 8.13.1-102; SanDisk ibi: before 8.13.1-102.
problem types: CWE-290 Authentication Bypass by Spoofing
affected:
{
defaultStatus: unaffected
platforms: Linux
product: My Cloud OS 5
vendor: Western Digital
versions:
lessThan: 5.25.132, status: affected, version: 0, versionType: custom
}
{
defaultStatus: unaffected
platforms: Linux
product: My Cloud Home and My Cloud Home Duo
vendor: Western Digital
versions:
lessThan:  8.13.1-102, status: affected, version: 0, versionType: custom
}
{
defaultStatus: unaffected
platforms: Linux
product: ibi
vendor: SanDisk
versions:
lessThan:  8.13.1-102, status: affected, version: 0, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 10
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
version: 3.1
]
format: CVSS
scenarios: GENERAL
solutions: All My Cloud Home, My Cloud Home Duo, and SanDisk ibi devices have been or will be automatically updated to the latest firmware version. Cloud access will not be available until your My Cloud Home/My Cloud Home Duo/SanDisk ibi device has been updated to firmware version 8.13.1-102 or above. Please refer to this  KBA https://support-en.wd.com/app/answers/detailweb/a_id/50563 .
Users of other My Cloud devices should promptly update to the latest firmware by clicking the firmware update notification to receive the latest security fixes. Cloud access will not be available until your My Cloud device has been updated to firmware version 5.25.132 or above. Please refer to this  KBA https://support-en.wd.com/app/answers/detailweb/a_id/50564 .