PT-2022-15768 · Western Digital · Edgerover

Published 2022-03-21 · Updated 2022-07-20 · CVE-2022-22998

Positive Technologies (AI Summary)

CVSS v3.1

8.0

High

Base vector

AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Western Digital EdgeRover versions prior to 1.5.1-594

Description A critical error has been discovered in Western Digital's EdgeRover desktop application, which poses a threat of privilege escalation in Windows and macOS, potentially allowing attackers to access confidential information and perform DoS attacks. The vulnerability is an error that allows unauthorized access to restricted directories and files. It is estimated that a significant number of people use EdgeRover for data management, given Western Digital's success as a manufacturer and retailer of digital data storage products.

Recommendations To resolve the issue, update Western Digital EdgeRover to version 1.5.1-594 or later. As a temporary workaround, consider using the default file manager that comes with your operating system to minimize the risk of exploitation.

Fix

Insufficiently Protected Credentials

Weakness Enumeration

CWE-522

Related Identifiers

CVE-2022-22998

Affected Products

Edgerover

References · 8

• https://osv.dev/vulnerability/CVE-2022-22998 · Vendor Advisory
• https://westerndigital.com/support/product-security/wdc-22009-my-cloud-home-firmware-version-8-7-0-107 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-22998 · Security Note
• https://t.me/cvenotify/33464 · Telegram Post
• https://t.me/nekaspersky/2021 · Telegram Post
• https://t.me/true_secator/2755 · Telegram Post
• https://t.me/tomhunter/885 · Telegram Post
• https://t.me/cibsecurity/46102 · Telegram Post