Advisory Summary

We addressed a previously unchecked buffer vulnerability in the Dynamic DNS client in My Cloud device firmware versions prior to 5.29.102 allows an attacker to potentially execute arbitrary code. A Man-in-the-Middle attack could be used to intercept a Dynamic DNS update request and respond with a payload that overflows the buffer.

CVE Number: CVE-2024-22170

Western Digital would like to thank Claroty Research - Team82 - Noam Moshe working with Trend Micro Zero Day Initiative