Auth bypass in Western Digital My Cloud
CVE-2022-22990
A limited authentication bypass vulnerability was discovered that could allow an attacker to achieve remote code execution and escalate privileges on the My Cloud devices. Addressed this vulnerability by changing access token validation logic and rewriting rule logic on PHP scripts.
Vulnerability class: Broken Authentication
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.8 (High). Vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N.
EPSS exploit prediction
EPSS: 0.021 (81.2th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 81st percentile — 81.2% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.021 · newest: 0.021 · change: 0.000
Affected products
- Western Digital My Cloud — versions My Cloud OS 5
- Westerndigital My Cloud
- Westerndigital My Cloud Dl2100
- Westerndigital My Cloud Dl4100
- Westerndigital My Cloud Ex2100
- Westerndigital My Cloud Ex2 Ultra
- Westerndigital My Cloud Ex4100
- Westerndigital My Cloud Mirror Gen 2
- Westerndigital My Cloud OS
- Westerndigital My Cloud Pr2100
Weakness classification (CWE)
References
- www.westerndigital.com/support/product-security/wdc-22002-my-cloud-os5-firmware… (Vendor Advisory)
- www.zerodayinitiative.com/advisories/ZDI-22-076/ (VDB Entry, Third Party Advisory)
- www.zerodayinitiative.com/advisories/ZDI-22-347/ (VDB Entry, Third Party Advisory)
Frequently asked questions
- What is CVE-2022-22990?
- CVE-2022-22990 is a high-severity vulnerability in Western Digital My Cloud, classified under Improper Authentication. CVSS score: 7.8/10. Published 2022-01-13.
- How severe is CVE-2022-22990?
- High severity. CVSS v3 base score is 7.8 out of 10.