CVE-2023-22819: wd cloud DoS — Fix

Description

An uncontrolled resource consumption vulnerability issue that could arise by sending crafted requests to a service to consume a large amount of memory, eventually resulting in the service being stopped and restarted was discovered in Western Digital My Cloud Home, My Cloud Home Duo, SanDisk ibi and Western Digital My Cloud OS 5 devices. This issue requires the attacker to already have root privileges in order to exploit this vulnerability. This issue affects My Cloud Home and My Cloud Home Duo: before 9.5.1-104; ibi: before 9.5.1-104; My Cloud OS 5: before 5.27.161.

Is your site exposed to CVE-2023-22819?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

4.9

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

Weakness Type (CWE)

CWE-770 CWE-770

CWE-400 Uncontrolled Resource Consumption

Affected Products

Vendor	Product	Versions
westerndigital	my_cloud_pr4100_firmware	< 5.27.161
westerndigital	my_cloud_pr4100	All
westerndigital	my_cloud_ex4100_firmware	< 5.27.161
westerndigital	my_cloud_ex4100	All
westerndigital	my_cloud_ex2_ultra_firmware	< 5.27.161
westerndigital	my_cloud_ex2_ultra	All
westerndigital	my_cloud_mirror_g2_firmware	< 5.27.161
westerndigital	my_cloud_mirror_g2	All
westerndigital	my_cloud_dl2100_firmware	< 5.27.161
westerndigital	my_cloud_dl2100	All
westerndigital	my_cloud_dl4100_firmware	< 5.27.161
westerndigital	my_cloud_dl4100	All
westerndigital	my_cloud_ex2100_firmware	< 5.27.161
westerndigital	my_cloud_ex2100	All
westerndigital	my_cloud_glacier_firmware	< 5.27.161
westerndigital	my_cloud_glacier	All
westerndigital	wd_cloud_firmware	< 5.27.161
westerndigital	wd_cloud	All
westerndigital	my_cloud_home_firmware	< 9.5.1-104
westerndigital	my_cloud_home	All
westerndigital	my_cloud_home_duo_firmware	< 9.5.1-104
westerndigital	my_cloud_home_duo	All
westerndigital	sandisk_ibi_firmware	< 9.5.1-104
westerndigital	sandisk_ibi	All

References

Advisories & Patches

https://www.westerndigital.com/support/product-security/wdc-24001-western-digital-my-cloud-os-5-my-cloud-home-duo-and-sandisk-ibi-firmware-update https://www.westerndigital.com/support/product-security/wdc-24001-western-digital-my-cloud-os-5-my-cloud-home-duo-and-sandisk-ibi-firmware-update

Frequently Asked Questions

What is CVE-2023-22819? +

An uncontrolled resource consumption vulnerability issue that could arise by sending crafted requests to a service to consume a large amount of memory, eventually resulting in the service being stopped and restarted was discovered in Western Digital My Cloud Home, My Cloud Home Duo, SanDisk ibi and Western Digital My Cloud OS 5 devices. This issue requires the attacker to already have root privileges in order to exploit this vulnerability. This issue affects My Cloud Home and My Cloud Home Duo: before 9.5.1-104; ibi: before 9.5.1-104; My Cloud OS 5: before 5.27.161. It has a CVSS v3.1 base score of 4.9 (MEDIUM).

How severe is CVE-2023-22819? +

CVE-2023-22819 has a CVSS v3.1 score of 4.9 out of 10, rated MEDIUM. This is a medium-severity vulnerability that should be remediated as part of regular maintenance.

What products are affected by CVE-2023-22819? +

CVE-2023-22819 affects products from westerndigital, specifically: my_cloud_dl2100, my_cloud_dl2100_firmware, my_cloud_dl4100, my_cloud_dl4100_firmware, my_cloud_ex2100, my_cloud_ex2100_firmware, my_cloud_ex2_ultra, my_cloud_ex2_ultra_firmware, my_cloud_ex4100, my_cloud_ex4100_firmware, my_cloud_glacier, my_cloud_glacier_firmware, my_cloud_home, my_cloud_home_duo, my_cloud_home_duo_firmware, my_cloud_home_firmware, my_cloud_mirror_g2, my_cloud_mirror_g2_firmware, my_cloud_pr4100, my_cloud_pr4100_firmware, sandisk_ibi, sandisk_ibi_firmware, wd_cloud, wd_cloud_firmware. Check the affected products table above for specific version ranges.

How do I check if I'm vulnerable to CVE-2023-22819? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2026-39313

mcp-framework is a framework for building Model Context Protocol (MCP) servers. In versions 0.2.21 and below, the readRequestBody() function in …

CVE-2026-35469

spdystream is a Go library for multiplexing streams over SPDY connections. In versions 0.5.0 and below, the SPDY/3 frame parser …

CVE-2026-39803

Allocation of Resources Without Limits or Throttling vulnerability in mtrudel bandit allows unauthenticated remote denial of service via memory exhaustion. …

CVE-2026-39804

Allocation of Resources Without Limits or Throttling vulnerability in mtrudel bandit allows unauthenticated remote denial of service via memory exhaustion …

CVE-2026-32688

Allocation of Resources Without Limits or Throttling vulnerability in elixir-plug plug_cowboy allows unauthenticated remote denial of service via atom table …

CVE-2026-10573

A denial-of-service security issue exists in 1734 POINT I/O™ module. The security issue stems from improper handling of crafted CIP …

CVE-2023-22819