CVE-2022-29837: Westerndigital My Cloud Home Duo Firmware

High severity, CVSS 7.8. EPSS: 0.2% chance of exploitation in the next 30 days.

A path traversal vulnerability was addressed in Western Digital My Cloud Home, My Cloud Home Duo and SanDisk ibi which could allow an attacker to initiate installation of custom ZIP packages and overwrite system files. This could potentially lead to a code execution.

Affected products

• Westerndigital My Cloud Home Duo Firmware: before 8.12.0-178 (fixed in 8.12.0-178)
• Westerndigital My Cloud Home Firmware: before 8.12.0-178 (fixed in 8.12.0-178)
• Westerndigital Sandisk Ibi Firmware: before 8.12.0-178 (fixed in 8.12.0-178)

Published 2022-12-01. Last modified 2026-06-17.