RCE in Western Digital My Cloud OS 5
CVE-2023-22815
Post-authentication remote command injection vulnerability in Western Digital My Cloud OS 5 devices that could allow an attacker to execute code in the context of the root user on vulnerable CGI files. This vulnerability can only be exploited over the network and the attacker must already have admin/root privileges to carry out the exploit. An authentication bypass is required for this exploit, thereby making it more complex. The attack may not require user interaction. Since an attacker must already be authenticated, the confidentiality impact is low while the integrity and availability impact is high. This issue affects My Cloud OS 5 devices: before 5.26.300.
Vulnerability class: Command Injection (OS Command Injection)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 6.2 (Medium). Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:H/A:H.
EPSS exploit prediction
EPSS: 0.013 (69.6th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 70th percentile — 69.6% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.013 · newest: 0.013 · change: 0.000
Affected products
- Western Digital My Cloud OS 5 — versions 0
- Westerndigital My Cloud
- Westerndigital My Cloud Dl2100
- Westerndigital My Cloud Dl4100
- Westerndigital My Cloud Ex2100
- Westerndigital My Cloud Ex2 Ultra
- Westerndigital My Cloud Ex4100
- Westerndigital My Cloud Mirror G2
- Westerndigital My Cloud OS
- Westerndigital My Cloud Pr2100
Weakness classification (CWE)
References
Frequently asked questions
- What is CVE-2023-22815?
- CVE-2023-22815 is a medium-severity vulnerability in Western Digital My Cloud OS 5, classified under OS Command Injection. CVSS score: 6.2/10. Published 2023-06-30.
- How severe is CVE-2023-22815?
- Medium severity. CVSS v3 base score is 6.2 out of 10.