CVE-2022-22990

A limited authentication bypass vulnerability was discovered that could allow an attacker to achieve remote code execution and escalate privileges on the My Cloud devices. Addressed this vulnerability by changing access token validation logic and rewriting rule logic on PHP scripts...

CVE-2022-22990

A limited authentication bypass vulnerability was discovered that could allow an attacker to achieve remote code execution and escalate privileges on the My Cloud devices. Addressed this vulnerability by changing access token validation logic and rewriting rule logic on PHP scripts...

CVE-2022-22989

My Cloud OS 5 was vulnerable to a pre-authenticated stack overflow vulnerability on the FTP service that could be exploited by unauthenticated attackers on the network. Addressed the vulnerability by adding defenses against stack overflow issues...

CVE-2022-22990

A limited authentication bypass vulnerability was discovered that could allow an attacker to achieve remote code execution and escalate privileges on the My Cloud devices. Addressed this vulnerability by changing access token validation logic and rewriting rule logic on PHP scripts...

Authentication flaw

A limited authentication bypass vulnerability was discovered that could allow an attacker to achieve remote code execution and escalate privileges on the My Cloud devices. Addressed this vulnerability by changing access token validation logic and rewriting rule logic on PHP scripts...

CVE-2022-22990

CVE-2022-22990 is a limited authentication bypass affecting Western Digital My Cloud devices. Multiple sources describe a vulnerability where an attacker could bypass authentication to trigger remote code execution and privilege escalation. The root cause is tied to improper access control, with ...

CVE-2022-22990 Limited authentication bypass vulnerability on Western Digital My Cloud devices

A limited authentication bypass vulnerability was discovered that could allow an attacker to achieve remote code execution and escalate privileges on the My Cloud devices. Addressed this vulnerability by changing access token validation logic and rewriting rule logic on PHP scripts...

CVE-2022-22991 Command injection through unsecured HTTP calls on Western Digital My Cloud devices

A malicious user on the same LAN could use DNS spoofing followed by a command injection attack to trick a NAS device into loading through an unsecured HTTP call. Addressed this vulnerability by disabling checks for internet connectivity using HTTP...

CVE-2022-22989 Pre-authenticated stack overflow vulnerability on FTP Service

My Cloud OS 5 was vulnerable to a pre-authenticated stack overflow vulnerability on the FTP service that could be exploited by unauthenticated attackers on the network. Addressed the vulnerability by adding defenses against stack overflow issues...

CVE-2022-22989

CVE-2022-22989 affects Western Digital My Cloud OS 5 via a pre-authenticated stack overflow in the FTP service, exploitable by unauthenticated network attackers. The issue is addressed by adding defenses against stack overflows; remediation cited in sources is to update to firmware 5.19.117 (and ...

PT-2022-15760 · Western Digital · Western Digital My Cloud

Name of the Vulnerable Software and Affected Versions: Western Digital My Cloud affected versions not specified Description: A limited authentication bypass issue was discovered, allowing an attacker to achieve remote code execution and escalate privileges on the My Cloud devices. The issue was...

Western Digital My Cloud 授权问题漏洞

Western Digital My Cloud is a personal cloud storage device from Western Digital, Inc. Western Digital My Cloud OS 5 is vulnerable to authorization issues that could be exploited by attackers to remotely execute code and escalate privileges...

PT-2022-15758 · Western Digital · My Cloud Os 5

Name of the Vulnerable Software and Affected Versions: My Cloud OS 5 Description: The issue concerns a pre-authenticated stack overflow vulnerability on the FTP service. This vulnerability could be exploited by unauthenticated attackers on the network. The problem was addressed by adding defenses...

Western Digital My Cloud 缓冲区错误漏洞

Western Digital My Cloud is a personal cloud storage device from Western Digital, Inc. A buffer overflow vulnerability exists in Western Digital My Cloud OS 5, which can be exploited by attackers to perform stack overflow attacks...

Western Digital My Cloud 命令注入漏洞

Western Digital My Cloud is a personal cloud storage device from Western Digital, Inc. A command injection vulnerability exists in Western Digital My Cloud OS 5, which could be exploited by attackers to use DNS spoofing and command injection attacks to trick NAS devices into loading via an insecu...

Western Digital My Cloud Multiple Products 5.0 < 5.18.117 Multiple Vulnerabilities (WDC-21012)

Multiple Western Digital My Cloud products are prone to multiple vulnerabilities. Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This progr...

Western Digital My Cloud Multiple Products 5.0 < 5.17.107 OpenSSL Vulnerabilities (WDC-21011)

Multiple Western Digital My Cloud products are prone to multiple vulnerabilities in OpenSSL. Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later...

Western Digital My Cloud Multiple Products 5.0 < 5.15.106 Unauthorized Access Vulnerability (WDC-21009)

Multiple Western Digital My Cloud products are prone to a vulnerability that could allow unauthorized access via SSH. Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...

Western Digital Users Face Another RCE

Bad news comes in threes, most particularly for Western Digital customers. As if things weren’t bad enough for the untold number of Western Digital customers whose data blinked out of existence last month, there’s another zero-day waiting for whoever can’t or won’t upgrade its My Cloud storage...

PT-2021-7663 · Western Digital · Western Digital My Cloud

Name of the Vulnerable Software and Affected Versions: Western Digital My Cloud devices before OS5 Description: The issue allows REST API access by low-privileged accounts, as demonstrated by API commands for firmware uploads and installation. This can potentially lead to the execution of arbitra...