PT-2022-15761 · Western Digital · Western Digital Mycloud Pr4100

Martin Rakhmanov + 1 · Published 2022-01-13 · Updated 2022-01-21 · CVE-2022-22991

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Western Digital MyCloud PR4100 (affected versions not specified)

Description A malicious user on the same LAN could use DNS spoofing followed by a command injection attack to trick a NAS device into loading through an unsecured HTTP call. The issue was addressed by disabling checks for internet connectivity using HTTP.

Recommendations To resolve the issue, disable checks for internet connectivity using HTTP. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

OS Command Injection

Command Injection

Weakness Enumeration

CWE-78

CWE-77

Related Identifiers

CVE-2022-22991

ZDI-22-077

Affected Products

Western Digital Mycloud Pr4100

References · 6

• https://zerodayinitiative.com/advisories/ZDI-22-077 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-22991 · Security Note
• https://westerndigital.com/support/product-security/wdc-22002-my-cloud-os5-firmware-5-19-117 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-22991 · Vendor Advisory
• https://t.me/cibsecurity/35456 · Telegram Post
• https://t.me/cvenotify/25556 · Telegram Post