PT-2022-15764 · Western Digital · Western Digital My Cloud

Martin Rakhmanov + 1 · Published 2022-01-28 · Updated 2022-03-15 · CVE-2022-22994

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Western Digital My Cloud devices (affected versions not specified)

Description A remote code execution issue was discovered, allowing an attacker to trick a NAS device into loading through an unsecured HTTP call due to insufficient verification of calls to the device. The vulnerability was addressed by disabling checks for internet connectivity using HTTP.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Insufficient Verification of Data Authenticity

Weakness Enumeration

CWE-345

Related Identifiers

CVE-2022-22994

ZDI-22-349

Affected Products

Western Digital My Cloud

References · 6

• https://osv.dev/vulnerability/CVE-2022-22994 · Vendor Advisory
• https://zerodayinitiative.com/advisories/ZDI-22-349 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-22994 · Security Note
• https://westerndigital.com/support/product-security/wdc-22002-my-cloud-os5-firmware-5-19-117 · Vendor Advisory
• https://t.me/cvenotify/26813 · Telegram Post
• https://t.me/cibsecurity/36494 · Telegram Post