Skip to content
CVE PROGRAM SOURCE RECORD8.8 High

CVE-2022-22994

Insufficient Verification of Data Authenticity Remote Code Execution Vulnerability on Western Digital My Cloud devices.

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
WDC PSIRT

Description

A remote code execution vulnerability was discovered on Western Digital My Cloud devices where an attacker could trick a NAS device into loading through an unsecured HTTP call. This was a result insufficient verification of calls to the device. The vulnerability was addressed by disabling checks for internet connectivity using HTTP.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Western Digital My Cloud

  • My Cloud OS 5 to < 5.19.117affected

References