CVE-2023-22813: Device API endpoint missing access controls on Western Digital Mobile and Web Apps

Severity: medium (CVSS 4.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-05-08 · updated 2026-06-17
Weakness: CWE-200

Description

A device API endpoint was missing access controls on Western Digital My Cloud OS 5 iOS and Anroid Mobile Apps, My Cloud Home iOS and Android Mobile Apps, SanDisk ibi iOS and Android Mobile Apps, My Cloud OS 5 Web App, My Cloud Home Web App and the SanDisk ibi Web App. Due to a permissive CORS policy and missing authentication requirement for private IPs, a remote attacker on the same network as the device could obtain device information by convincing a victim user to visit an attacker-controlled server and issue a cross-site request. This issue affects My Cloud OS 5 Mobile App: before 4.21.0; My Cloud Home Mobile App: before 4.21.0; ibi Mobile App: before 4.21.0; My Cloud OS 5 Web App: before 4.26.0-6126; My Cloud Home Web App: before 4.26.0-6126; ibi Web App: before 4.26.0-6126.

Affected products

Huawei Technologies Co., Ltd. MyCloud: before 4.26.0-6126 — fixed in 4.26.0-6126
Western Digital My Cloud Home: before 4.21.0; before 4.26.0-6126 — fixed in 4.21.0, 4.26.0-6126
Westerndigital My Cloud Os 5: before 4.21.0 — fixed in 4.21.0
Westerndigital Sandisk Ibi: before 4.21.0; before 4.26.0-6126 — fixed in 4.21.0, 4.26.0-6126

How to fix

Upgrade to a fixed version: Huawei Technologies Co., Ltd. MyCloud 4.26.0-6126; Western Digital My Cloud Home 4.21.0, 4.26.0-6126; Westerndigital My Cloud Os 5 4.21.0; Westerndigital Sandisk Ibi 4.21.0, 4.26.0-6126. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2023-22813 or the next vulnerability affects your stack