CyberSecBulletin
CVE-2022-23000NVD status: Modified

My Cloud: Selection of Less-Secure Algorithm During Negotiation

Published Updated By the CyberSecBulletin desk

CVE-2022-23000 is a high-severity selection of less-secure algorithm during negotiation vulnerability in My Cloud from Western Digital, with a CVSS 3.1 base score of 7.8 out of 10. It can be exploited with local access to the system by an attacker with a low-privileged account, without any action from a user. The record lists version 5.23.114 as the first without the flaw, so updating My Cloud to that release or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.19% chance of exploitation within 30 days, which is low compared with other CVEs.

Next patch cycle

High severity with no evidence of exploitation so far.

What to do

  1. Update My Cloud to 5.23.114 or a later version.
  2. Update My Cloud Pr2100 Firmware to 5.23.114 or a later version.
  3. Update My Cloud Pr4100 Firmware to 5.23.114 or a later version.
  4. Read the advisory on westerndigital.com for workarounds and exact fixed builds.

Affected products and versions

VendorProductAffected versionsFixed in
Western DigitalMy CloudMy Cloud OS 5 up to, but not including, 5.23.1145.23.114
WesterndigitalMy Cloud Pr2100 Firmwarebefore 5.23.1145.23.114
WesterndigitalMy Cloud Pr4100 Firmwarebefore 5.23.1145.23.114
WesterndigitalMy Cloud Ex4100 Firmwarebefore 5.23.1145.23.114
WesterndigitalMy Cloud Ex2 Ultra Firmwarebefore 5.23.1145.23.114
WesterndigitalMy Cloud Mirror G2 Firmwarebefore 5.23.1145.23.114
WesterndigitalMy Cloud Dl2100 Firmwarebefore 5.23.1145.23.114
WesterndigitalMy Cloud Dl4100 Firmwarebefore 5.23.1145.23.114
WesterndigitalMy Cloud Ex2100 Firmwarebefore 5.23.1145.23.114
WesterndigitalMy Cloud Firmwarebefore 5.23.1145.23.114

Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector
LocalThe attacker needs local access or must trick a user into running something.
Attack complexity
LowNo special conditions are needed; the attack works reliably.
Privileges required
LowA basic user account is enough.
User interaction
NoneNo action by a victim is required.
Scope
UnchangedImpact stays within the vulnerable component.
Confidentiality
HighAll data handled by the component can be read.
Integrity
HighData or code can be modified at will.
Availability
HighThe component can be taken down completely.

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. Scored by NVD.

Scoring systemScoreSeverityScored by
CVSS 3.17.3HighCNA (wdc.com)
CVSS 3.17.8HighNVD

Official description

The Western Digital My Cloud Web App [https://os5.mycloud.com/] uses a weak SSLContext when attempting to configure port forwarding rules. This was enabled to maintain compatibility with old or outdated home routers. By using an "SSL" context instead of "TLS" or specifying stronger validation, deprecated or insecure protocols are permitted. As a result, a local user with no privileges can exploit this vulnerability and jeopardize the integrity, confidentiality and authenticity of information transmitted. The scope of impact cannot extend to other components and no user input is required to exploit this vulnerability.

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: Selection of Less-Secure Algorithm During Negotiation

A protocol or its implementation supports interaction between multiple actors and allows those actors to negotiate which algorithm should be used in a protection mechanism such as encryption or authentication, but it does not select the strongest algorithm that is available to both parties.

More Selection of Less-Secure Algorithm During Negotiation vulnerabilities (CWE-757)

Timeline

  1. CVE record published.
  2. Record last changed materially (score, affected products, status or references).

References

Other vulnerabilities in My Cloud

All My Cloud vulnerabilities

Spotted an error? Tell us.