Vulnerability · Published Jan 28, 2022 · Assigned by WDC PSIRT
CVE-2022-22994Insufficient Verification of Data Authenticity Remote Code Execution Vulnerability on Western Digital My Cloud devices.
High 8.8
In plain English
A high-severity insufficient verification of data authenticity in My Cloud from Western Digital. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.9% (higher than 79% of all known vulnerabilities).
Official description
A remote code execution vulnerability was discovered on Western Digital My Cloud devices where an attacker could trick a NAS device into loading through an unsecured HTTP call. This was a result insufficient verification of calls to the device. The vulnerability was addressed by disabling checks for internet connectivity using HTTP.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Western Digital | My Cloud | My Cloud OS 5 – before 5.19.117 |
Weakness: CWE-345 · Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H