WDC PSIRTCVELIST:CVE-2022-22991CVE-2022-22991 Command injection through unsecured HTTP calls on Western Digital My Cloud devices
7.8 High
CVSS3
Attack Vector
LOCAL
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
NONE
Scope
CHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
NONE
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N
9.5 High
AI Score
Confidence
High
0.001 Low
EPSS
Percentile
38.9%
A malicious user on the same LAN could use DNS spoofing followed by a command injection attack to trick a NAS device into loading through an unsecured HTTP call. Addressed this vulnerability by disabling checks for internet connectivity using HTTP.
CNA Affected
[
{
"product": "My Cloud",
"vendor": "Western Digital",
"versions": [
{
"lessThan": "5.19.117",
"status": "affected",
"version": "My Cloud OS 5",
"versionType": "custom"
}
]
}
]Related
7.8 High
CVSS3
Attack Vector
LOCAL
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
NONE
Scope
CHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
NONE
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N
9.5 High
AI Score
Confidence
High
0.001 Low
EPSS
Percentile
38.9%