← Database

CVE-2022-22994

HIGH CVSS: 8.8 Published: 2022-01-28 Modified: 2026-06-17

Description

A remote code execution vulnerability was discovered on Western Digital My Cloud devices where an attacker could trick a NAS device into loading through an unsecured HTTP call. This was a result insufficient verification of calls to the device. The vulnerability was addressed by disabling checks for internet connectivity using HTTP.

Affected Platforms

Westerndigital My Cloud OsWesterndigital My Cloud Pr2100Westerndigital My Cloud Pr4100Westerndigital My Cloud Dl2100Westerndigital My Cloud Ex2100Westerndigital My CloudWesterndigital Wd CloudWesterndigital My Cloud Mirror Gen 2Westerndigital My Cloud Ex2 UltraWesterndigital My Cloud Dl4100

Weakness Type

CWE-345, CWE-345

References