← Database

CVE-2022-22990

HIGH CVSS: 7.8 Published: 2022-01-13 Modified: 2026-06-17

Description

A limited authentication bypass vulnerability was discovered that could allow an attacker to achieve remote code execution and escalate privileges on the My Cloud devices. Addressed this vulnerability by changing access token validation logic and rewriting rule logic on PHP scripts.

Affected Platforms

Westerndigital My Cloud OsWesterndigital My Cloud Pr2100Westerndigital My Cloud Pr4100Westerndigital My Cloud Dl2100Westerndigital My Cloud Ex2100Westerndigital My CloudWesterndigital Wd CloudWesterndigital My Cloud Mirror Gen 2Westerndigital My Cloud Ex2 UltraWesterndigital My Cloud Dl4100

Weakness Type

CWE-287, CWE-697

References