Skip to content
OpenAdvisories
High · 7.8 CVE-2022-22990 EUVD-2022-28101GHSA-qqqv-wfvc-wrgw

Limited authentication bypass vulnerability on Western Digital My Cloud devices

Published Jan 13, 2022 · Updated Aug 3, 2024 · Assigned by WDC PSIRT

Description

A limited authentication bypass vulnerability was discovered that could allow an attacker to achieve remote code execution and escalate privileges on the My Cloud devices. Addressed this vulnerability by changing access token validation logic and rewriting rule logic on PHP scripts.

Affected products

VendorProductAffectedFixed
Western Digital My Cloud My Cloud OS 5 – < 5.19.117 5.19.117

References