Skip to content
CVE PROGRAM SOURCE RECORD7.8 High

CVE-2022-22991

Command injection through unsecured HTTP calls on Western Digital My Cloud devices

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
WDC PSIRT

Description

A malicious user on the same LAN could use DNS spoofing followed by a command injection attack to trick a NAS device into loading through an unsecured HTTP call. Addressed this vulnerability by disabling checks for internet connectivity using HTTP.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Western Digital My Cloud

  • My Cloud OS 5 to < 5.19.117affected

References