Skip to content
OpenAdvisories
Medium · 6.7 CVE-2022-29844 EUVD-2022-34162GHSA-6r45-66xq-p89w

Western Digital My Cloud OS 5 arbitrary file read and write vulnerability via ftp

Published Jan 25, 2023 · Updated Apr 4, 2025 · Assigned by WDC PSIRT

Description

A vulnerability in the FTP service of Western Digital My Cloud OS 5 devices running firmware versions prior to 5.26.119 allows an attacker to read and write arbitrary files. This could lead to a full NAS compromise and would give remote execution capabilities to the attacker.

Affected products

VendorProductAffectedFixed
Western Digital My Cloud My Cloud OS 5 – < 5.26.119 5.26.119

References