← Database

CVE-2022-22991

HIGH CVSS: 7.8 Published: 2022-01-13 Modified: 2026-06-17

Description

A malicious user on the same LAN could use DNS spoofing followed by a command injection attack to trick a NAS device into loading through an unsecured HTTP call. Addressed this vulnerability by disabling checks for internet connectivity using HTTP.

Affected Platforms

Westerndigital My Cloud OsWesterndigital My Cloud Pr2100Westerndigital My Cloud Pr4100Westerndigital My Cloud Dl2100Westerndigital My Cloud Ex2100Westerndigital My CloudWesterndigital Wd CloudWesterndigital My Cloud Mirror Gen 2Westerndigital My Cloud Ex2 UltraWesterndigital My Cloud Dl4100

Weakness Type

CWE-78, CWE-77

References