EUVD-2022-28102

🗓️ 03 Oct 2025 20:07:09Reported by EUVDType

Malicious user can exploit DNS spoofing and command injection on NAS devices via unsecured HTTP calls.

Reporter	Title	Published	Views	Family All 11
ATTACKERKB	CVE-2022-22991	13 Jan 202221:15	–	attackerkb
Circl	CVE-2022-22991	14 Jan 202200:18	–	circl
CNNVD	Western Digital My Cloud 命令注入漏洞	13 Jan 202200:00	–	cnnvd
CNVD	Western Digital My Cloud OS 5 Command Injection Vulnerability	17 Jan 202200:00	–	cnvd
CVE	CVE-2022-22991	13 Jan 202220:27	–	cve
Cvelist	CVE-2022-22991 Command injection through unsecured HTTP calls on Western Digital My Cloud devices	13 Jan 202220:27	–	cvelist
NVD	CVE-2022-22991	13 Jan 202221:15	–	nvd
OpenVAS	Western Digital My Cloud Multiple Products 5.0 < 5.19.117 Multiple Vulnerabilities (WDC-22002, WDC-22005)	17 Jan 202200:00	–	openvas
Prion	Command injection	13 Jan 202221:15	–	prion
RedhatCVE	CVE-2022-22991	5 Feb 202520:07	–	redhatcve

[
  {
    "enisaIdVendor": [
      {
        "id": "ce3a0d1f-7213-3ff2-a15a-02401f217952",
        "vendor": {
          "name": "Western Digital"
        }
      }
    ],
    "enisaIdProduct": [
      {
        "id": "410ae83d-ffbe-35b3-80d2-732168722134",
        "product": {
          "name": "My Cloud"
        },
        "product_version": "My Cloud OS 5 <5.19.117"
      }
    ]
  }
]

Source	Link
westerndigital	www.westerndigital.com/support/product-security/wdc-22002-my-cloud-os5-firmware-5-19-117
zerodayinitiative	www.zerodayinitiative.com/advisories/ZDI-22-077/

03 Oct 2025 20:07Current

8.8High risk

Vulners AI Score8.8

CVSS 3.17.8 - 8.8

CVSS 28.3

EPSS0.00084