What is CVE-2022-22992?

CVE-2022-22992 is a high-severity vulnerability in Westerndigital My_cloud, classified under Improper Encoding or Escaping of Output. CVSS score: 7.8/10. Published 2022-01-28.

How severe is CVE-2022-22992?

High severity. CVSS v3 base score is 7.8 out of 10.

Vulnerability in Westerndigital My_cloud

CVE-2022-22992

A command injection remote code execution vulnerability was discovered on Western Digital My Cloud Devices that could allow an attacker to execute arbitrary system commands on the device. The vulnerability was addressed by escaping individ…

EPSS: 0.023 (81.2th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.8 (High). Vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N.

Affected products

Westerndigital My_cloud
Westerndigital My_cloud_dl2100
Westerndigital My_cloud_dl4100
Westerndigital My_cloud_ex2100
Westerndigital My_cloud_ex2_ultra
Westerndigital My_cloud_ex4100
Westerndigital My_cloud_mirror_gen_2
Westerndigital My_cloud_os
Westerndigital My_cloud_pr2100
Westerndigital My_cloud_pr4100

Weakness classification (CWE)

CWE-116 — Improper Encoding or Escaping of Output

References

psirt@wdc.com (x_refsource_MISC, Vendor Advisory)

Frequently asked questions

What is CVE-2022-22992?: CVE-2022-22992 is a high-severity vulnerability in Westerndigital My_cloud, classified under Improper Encoding or Escaping of Output. CVSS score: 7.8/10. Published 2022-01-28.
How severe is CVE-2022-22992?: High severity. CVSS v3 base score is 7.8 out of 10.