CVE-2022-23006 — CVE & Security Advisory Radar

🎯 CVE-2022-23006 LOW 1.8 🔥 EPSS 28% 🇪🇺 EUVD

📄 .md Alle CVEs anzeigen ✕

CVE-2022-23006 | A stack-based buffer overflow vulnerability was found on Western Digital My Cloud Home, My Cloud Home Duo, and SanDisk ibi that could allow an attacker accessing the system locally to read information from /etc/version file. This vulnerability can only be exploited by chaining it with another issue. If an attacker is able to carry out a remote code execution attack, they can gain access to the vulnerable file, due to the presence of insecure functions in code

A stack-based buffer overflow vulnerability was found on Western Digital My Cloud Home, My Cloud Home Duo, and SanDisk ibi that could allow an attacker accessing the system locally to read information from /etc/version file. This vulnerability can only be exploited by chaining it with another issue. If an attacker is able to carry out a remote code execution attack, they can gain access to the vulnerable file, due to the presence of insecure functions in code. User interaction is required for exploitation. Exploiting the vulnerability could result in exposure of information, ability to modify files, memory access errors, or system crashes.

Klassifikation & Betroffenheit:

Western DigitalSanDisk My Cloud Home 8.10.0-117 <8.10.0-117My Cloud Home Duo 8.10.0-117 <8.10.0-117ibi 8.10.0-117 <8.10.0-117westerndigital my_cloud_home_firmware *westerndigital my_cloud_home_duo_firmware *westerndigital sandisk_ibi_firmware *

Improper Restriction of Operations within the Bounds of a Memory Buffer 🎯 High

The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.

🛡️ Empfohlene Mitigation: Use a language that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid. For example, many languages that perform their own memory management, such as Java and Perl, are not subject to buffer overflows. Other languages, such as Ada and C#, typically provide overflow prot…

Vollständige Definition bei MITRE ➔

⚔️ Typische Angriffsmuster (CAPEC):

CAPEC-10 · Buffer Overflow via Environment Variable… (High) CAPEC-14 · Client-side Injection-induced Buffer Ove… (High) CAPEC-24 · Filter Failure through Buffer Overflow (High) CAPEC-42 · MIME Conversion (High) CAPEC-44 · Overflow Binary Resource File (Very High) CAPEC-45 · Buffer Overflow via Symbolic Links (High) CAPEC-100 · Overflow Buffers (Very High) CAPEC-123 · Buffer Manipulation (Very High)

🧩 Ähnliche Schwachstellen (Hersteller/Klasse/Score-Band):

CVE-2022-36330 1.9 CVE-2022-29836 1.9

📚 Referenzen & Quellen:

🇪🇺 Original-Eintrag (ENISA EUVD) 🇺🇸 NVD-Eintrag

Ausnutzungs-Zeitleiste:

Reserviert 2022

Veröffentlicht 09/2022

Heute 13.09.

CVSS-Vektor-Analyse: 1.8

AV · Angriffsvektor Lokal

AC · Komplexität Hoch

PR · Privilegien Hoch

UI · Interaktion Erforderlich

S · Scope Unverändert

C · Vertraulichkeit Gering

I · Integrität Keine

A · Verfügbarkeit Keine

CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:L/I:N/A:N

Veröffentlicht:27.09.2022

Aktualisiert:17.06.2026 04:29

Assigner (CNA):WDC PSIRT

EUVD-ID:EUVD-2022-28117

Quellen: 🇪🇺 EUVD-Datenbank (ENISA) + 🇺🇸 NVD-Anreicherung · 24-h-Cache

CWE-119: Memory Corruption ✓ Offizieller Patch / Advisory verfügbar

💡 Gegenmaßnahme: Sicherheits-Update des Herstellers zeitnah einspielen und Netzwerksegmentierung prüfen.

Tier	2026-08-29	2026-09-12
≥90 %	4	0
≥50 %	4	0
≥10 %	3	0
<10 %	304	300

1.8 LOW

🇪🇺 EUVD

EPSS

28%

CVE-2022-23006 💻 Lokal 🔐 Admin-Rechte nötig

Western Digital

CVE-2022-23006 | A stack-based buffer overflow vulnerability was found on Western Digital My Cloud Home, My Cloud Home Duo, and SanDisk ibi that could allow an attacker accessing the system locally to read information from /etc/version file. This vulnerability can only be exploited by chaining it with another issue. If an attacker is able to carry out a remote code execution attack, they can gain access to the vulnerable file, due to the presence of insecure functions in code

CWE-119: Memory Corruption ✓ Offizieller Patch / Advisory verfügbar

💡 Gegenmaßnahme: Sicherheits-Update des Herstellers zeitnah einspielen und Netzwerksegmentierung prüfen.

27.09.2022

🛡️ Details ➔

Zero-Day & Vulnerability Intelligence Hub