My Cloud devices running older firmware have been blocked from accessing Western Digital’s cloud services until they are updated to the latest versions. Credit: WD Western Digital has blocked devices running vulnerable firmware versions from accessing its cloud services, the company said in an advisory. The move comes about a month after the company released firmware updates for its My Cloud product line to address a critical path traversal bug that leads to remote code execution (RCE). "Devices running unpatched firmware versions will not be able to connect to Western Digital cloud services starting June 15, 2023, and users will not be able to access their data until the device updates to the latest firmware," the company said. Users can, however, continue to access their data via Local Access, the procedure that enables access through network-mapped drives on a local network. Flaw patched in May The issue, tracked as CVE-2022-36327 with 9.8 CVSS severity, could allow an attacker to write files to locations with certain filesystem types leading to remote code execution in Western Digital My Cloud Home, My Cloud Home Duo, ScanDisk ibi and Western Digital My Cloud OS 5 devices. The vulnerability required an authentication bypass issue to be triggered before it could be exploited. It affected My Cloud Home and My Cloud Home Duo: before 9.4.0-191, ScanDisk ibi: before 9.4.0-191, and My Cloud OS 5: before 5.26.202. Western Digital released My Cloud OS 5 firmware version 5.26.202 on May 15, which addressed this bug and three other medium-severity issues. These other issues included uncontrolled resource consumption leading to denial-of-service (DoS), path traversal leading to sensitive information disclosure, and server-side request forgery (SSRF) bugs that can lead to the exploitation of other vulnerabilities. On May 25, the company released firmware version 9.4.1-101 to resolve the SSRF bug in My Cloud Home, My Cloud Home Duo, and SanDisk ibi devices. Possibly exploited by BlackCat Last month, ransomware group BlackCat released a set of screenshots on its leak site that it claimed were from data stolen from the Western Digital breach. The images included screenshots of videoconferences and internal emails of the company. The screenshots also included an image of a recent meeting held by Western Digital where the company was discussing how to respond to the cyberattack. Western Digital had disclosed the April 3 incident as a network breach where an unauthorized third party gained access to several of the company's systems. The company had also said that it was taking down certain systems and services offline as a proactive security measure. These systems included My Cloud, My Cloud Home, My Cloud Home Duo, My Cloud OS 5, and ScanDisk ibi services as several users reported temporarily losing access to them. Following the release of screenshots, BlackCat posted a note stating it would eventually put Western Digital's intellectual property on sale. There were no further updates on the issue thereon, with no confirmation of any ransom demanded. Related content news Amazon debuts biometric security device, updates Detective and GuardDuty Amazon’s latest security offerings, announced at its re:Invent conference, cover everything from advanced biometrics to new tools for defeating runtime and cloud threats, including identity and access management (IAM) capabilities. By Jon Gold Nov 29, 2023 3 mins Biometrics Security Monitoring Software Threat and Vulnerability Management news Almost all developers are using AI despite security concerns, survey suggests About 96% of developers are using AI tools and nearly eight out of 10 coders are bypassing security policies to use them, while placing unfounded trust into AI’s competence and security, according to the report by Snyk. By John Mello Jr. Nov 29, 2023 4 mins Development Tools Security Practices Supply Chain news FBI probes Pennsylvanian water utility hack by pro-Iran group Federal and state investigations are underway for the recent pro-Iran hack into a Pennsylvania-based water utility targeting Israel-made equipment. By Shweta Sharma Nov 29, 2023 4 mins Cyberattacks Utilities Industry feature 3 ways to fix old, unsafe code that lingers from open-source and legacy programs Code vulnerability is not only a risk of open-source code, with many legacy systems still in use — whether out of necessity or lack of visibility — the truth is that cybersecurity teams will inevitably need to address the problem. By Maria Korolov Nov 29, 2023 9 mins Security Practices Vulnerabilities Security Podcasts Videos Resources Events SUBSCRIBE TO OUR NEWSLETTER From our editors straight to your inbox Get started by entering your email address below. Please enter a valid email address Subscribe