Western Digital Blocks Legacy NAS from Accessing Cloud Services

Western Digital warns owners of older NAS My Cloud series devices that they cannot connect to cloud services after June 15, 2023 unless their device is updated to the latest firmware (5.26.202).

And the media recently reported that Western Digital Admits that Users’ Personal Data Was Compromised in the Company’s Hack.

The manufacturer says this decision was made to protect users from cyberattacks, as the latest NAS firmware patches a remote exploitable vulnerability that can be used to execute arbitrary code.

Western Digital has warned NAS owners that the following devices must be upgraded to the specified versions or they will no longer be able to access My Cloud:

1. My Cloud PR2100 – 5.26.202 or newer;
2. My Cloud PR4100 – 5.26.202 or newer;
3. My Cloud EX4100 – 5.26.202 or newer;
4. My Cloud EX2 Ultra – 5.26.202 or newer;
5. My Cloud Mirror G2 – 5.26.202 or newer;
6. My Cloud DL2100 – 5.26.202 or newer;
7. My Cloud DL4100 – 5.26.202 or newer;
8. My Cloud EX2100 – 5.26.202 or newer;
9. My Cloud – 5.26.202 or newer;
10. WD Cloud – 5.26.202 or newer;
11. My Cloud Home – 9.4.1-101 or newer;
12. My Cloud Home Duo – 9.4.1-101 or newer;
13. SanDisk ibi – 9.4.1-101 or newer.

The listed firmware versions were released on May 15, 2023 and fix the following vulnerabilities:

1. CVE-2022-36327 – A critical path traversal vulnerability (9.8 on the CVSS scale) that allows an attacker to write files to arbitrary locations in the file system, which leads to remote code execution without authentication on My Cloud devices;
2. CVE-2022-36326 – An uncontrolled resource consumption vulnerability that can be triggered by specially crafted requests sent to vulnerable devices, resulting in a denial of service;
3. CVE-2022-36328 is another path traversal bug that allows an authenticated attacker to create arbitrary shares in arbitrary directories and steal sensitive files, passwords, users, and device configurations;
4. CVE-2022-29840 is an SSRF (Server-Side Request Forgery) vulnerability that allows a malicious server on a local network to change its URL in such a way as to create a loop.