Vulnerability · Published Jan 25, 2023 · Assigned by WDC PSIRT
CVE-2022-29844Western Digital My Cloud OS 5 arbitrary file read and write vulnerability via ftp
Medium 6.7
In plain English
A medium-severity security flaw in My Cloud from Western Digital. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 36.4% (higher than 98% of all known vulnerabilities).
Severity (CVSS 3.1)6.7Medium
Exploit odds (30 days)36.4%top 1.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
A vulnerability in the FTP service of Western Digital My Cloud OS 5 devices running firmware versions prior to 5.26.119 allows an attacker to read and write arbitrary files. This could lead to a full NAS compromise and would give remote execution capabilities to the attacker.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Western Digital | My Cloud | My Cloud OS 5 – before 5.26.119 |
Weakness: CWE-23 · Vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N