← Database

CVE-2023-22817

MEDIUM CVSS: 5.5 Published: 2024-02-05 Modified: 2026-06-17

Description

Server-side request forgery (SSRF) vulnerability that could allow a rogue server on the local network to modify its URL using another DNS address to point back to the loopback adapter. This could then allow the URL to exploit other vulnerabilities on the local server. This was addressed by fixing DNS addresses that refer to loopback. This issue affects My Cloud OS 5 devices before 5.27.161, My Cloud Home, My Cloud Home Duo and SanDisk ibi devices before 9.5.1-104. 

Affected Platforms

Westerndigital My Cloud Home Duo FirmwareWesterndigital My Cloud Dl2100Westerndigital My Cloud Glacier FirmwareWesterndigital My Cloud Ex2 UltraWesterndigital My Cloud Ex2 Ultra FirmwareWesterndigital My Cloud Dl4100Westerndigital My Cloud GlacierWesterndigital My Cloud Home DuoWesterndigital My Cloud Pr2100 FirmwareWesterndigital My Cloud Mirror G2

Weakness Type

CWE-918, CWE-918

References