Lucene search

WDC PSIRTCVELIST:CVE-2022-22997

HistoryJul 12, 2022 - 8:22 p.m.

CVE-2022-22997 Command Injection Vulnerability on My Cloud Home

2022-07-1220:22:36

CWE-78

WDC PSIRT

www.cve.org

6.8 Medium

CVSS3

Attack Vector

ADJACENT

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

0.003 Low

EPSS

Percentile

71.6%

JSON

Addressed a remote code execution vulnerability by resolving a command injection vulnerability and closing an AWS S3 bucket that potentially allowed an attacker to execute unsigned code on My Cloud Home devices.

CNA Affected

[
  {
    "platforms": [
      "Linux"
    ],
    "product": "My Cloud Home",
    "vendor": "Western Digital",
    "versions": [
      {
        "lessThan": "8.5.1-102",
        "status": "affected",
        "version": "My Cloud Home Firmware",
        "versionType": "custom"
      }
    ]
  }
]

References

www.westerndigital.com/support/product-security/wdc-22009-my-cloud-home-firmware-version-8-7-0-107

6.8 Medium

CVSS3

Attack Vector

ADJACENT

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

0.003 Low

EPSS

Percentile

71.6%

JSON

Related for CVELIST:CVE-2022-22997