Vulnerability · Published Dec 9, 2022 · Assigned by WDC PSIRT
CVE-2022-29838Authentication issue with the encrypted volumes and auto mount feature in My Cloud devices
Medium 4.3
In plain English
A medium-severity improper authentication in My Cloud from Western Digital. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 19% of all known vulnerabilities).
Severity (CVSS 3.1)4.3Medium
Exploit odds (30 days)0.3%top 80.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Improper Authentication vulnerability in the encrypted volumes and auto mount features of Western Digital My Cloud devices allows insecure direct access to the drive information in the case of a device reset. This issue affects: Western Digital My Cloud My Cloud versions prior to 5.25.124 on Linux.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Western Digital | My Cloud | My Cloud – before 5.25.124 |
Weakness: CWE-287 · Vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N