Vulnerability · Published Jan 13, 2022 · Assigned by WDC PSIRT
CVE-2022-22991Command injection through unsecured HTTP calls on Western Digital My Cloud devices
High 7.8
In plain English
A high-severity OS command injection in My Cloud from Western Digital. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.3% (higher than 71% of all known vulnerabilities).
Severity (CVSS 3.1)7.8High
Exploit odds (30 days)1.3%top 28.8% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
A malicious user on the same LAN could use DNS spoofing followed by a command injection attack to trick a NAS device into loading through an unsecured HTTP call. Addressed this vulnerability by disabling checks for internet connectivity using HTTP.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Western Digital | My Cloud | My Cloud OS 5 – before 5.19.117 |
Weakness: CWE-78 · Vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N