Vulnerability in Western Digital My Cloud
CVE-2022-23000
The Western Digital My Cloud Web App [https://os5.mycloud.com/] uses a weak SSLContext when attempting to configure port forwarding rules. This was enabled to maintain compatibility with old or outdated home routers. By using an "SSL" context instead of "TLS" or specifying stronger validation, deprecated or insecure protocols are permitted. As a result, a local user with no privileges can exploit this vulnerability and jeopardize the integrity, confidentiality and authenticity of information transmitted. The scope of impact cannot extend to other components and no user input is required to exploit this vulnerability.
EPSS: 0.002 (8.8th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.3 (High). Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L.
Affected products
- Western Digital My Cloud — versions My Cloud OS 5
- Westerndigital My_cloud
- Westerndigital My_cloud_dl2100
- Westerndigital My_cloud_dl2100_firmware
- Westerndigital My_cloud_dl4100
- Westerndigital My_cloud_dl4100_firmware
- Westerndigital My_cloud_ex2100
- Westerndigital My_cloud_ex2100_firmware
- Westerndigital My_cloud_ex2_ultra
- Westerndigital My_cloud_ex2_ultra_firmware
Weakness classification (CWE)
References
- psirt@wdc.com (x_refsource_MISC, Vendor Advisory)
Frequently asked questions
- What is CVE-2022-23000?
- CVE-2022-23000 is a high-severity vulnerability in Western Digital My Cloud, classified under CWE-757. CVSS score: 7.3/10. Published 2022-07-25.
- How severe is CVE-2022-23000?
- High severity. CVSS v3 base score is 7.3 out of 10.