A device API endpoint was missing access controls on Western Digital My Cloud OS 5 iOS and Anroid Mobile Apps, My Cloud Home iOS and Android Mobile Apps, SanDisk ibi iOS and Android Mobile Apps, My Cloud OS 5 Web App, My Cloud Home Web App and the SanDisk ibi Web App. Due to a permissive CORS policy and missing authentication requirement for private IPs, a remote attacker on the same network as the device could obtain device information by convincing a victim user to visit an attacker-controlled server and issue a cross-site request. This issue affects My Cloud OS 5 Mobile App: before 4.21.0; My Cloud Home Mobile App: before 4.21.0; ibi Mobile App: before 4.21.0; My Cloud OS 5 Web App: before 4.26.0-6126; My Cloud Home Web App: before 4.26.0-6126; ibi Web App: before 4.26.0-6126.
AI analysis not yet available
Plain-English explanation, risk summary, and remediation steps will appear here once AI analysis is complete.
No Fix Known
No patch has been released yet. Apply workarounds or mitigations where available.
| Vendor | Product | Versions | Fixed In |
|---|---|---|---|
| westerndigital | my_cloud | 4.26.0-6126 | - |
| westerndigital | my_cloud_home | 4.21.0 |
Published
CVE disclosed publicly
Last Modified
Most recent update
Indexed to CVEInsight
Added to this platform
AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
9
Affected Products
2
References
westerndigital / my_cloud
| - |
| westerndigital | my_cloud_home | 4.21.0 | - |
| westerndigital | my_cloud_home | 4.26.0-6126 | - |
| westerndigital | my_cloud_os_5 | 4.21.0 | - |
| westerndigital | my_cloud_os_5 | 4.21.0 | - |
| westerndigital | sandisk_ibi | 4.21.0 | - |
| westerndigital | sandisk_ibi | 4.21.0 | - |
| westerndigital | sandisk_ibi | 4.26.0-6126 | - |
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Exploitability
Impact