1. Home
  2. CVE Database
  3. CVE-2022-22990
HIGH · 7.8

CVE-2022-22990

A limited authentication bypass vulnerability was discovered that could allow an attacker to achieve remote code execution and escalate privileges on the My Cloud devices. Addressed this vulnerability...

Vulnerability Description

A limited authentication bypass vulnerability was discovered that could allow an attacker to achieve remote code execution and escalate privileges on the My Cloud devices. Addressed this vulnerability by changing access token validation logic and rewriting rule logic on PHP scripts.

CVSS Score

7.8

HIGH

CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N
Attack Vector
LOCAL
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
NONE
Scope
CHANGED
Confidentiality
HIGH
Integrity
HIGH
Availability
NONE

Affected Products

VendorProductVersions
WesterndigitalMy Cloud Os< 5.19.117
WesterndigitalMy Cloud-
WesterndigitalMy Cloud Dl2100-
WesterndigitalMy Cloud Dl4100-
WesterndigitalMy Cloud Ex2 Ultra-
WesterndigitalMy Cloud Ex2100-
WesterndigitalMy Cloud Ex4100-
WesterndigitalMy Cloud Mirror Gen 2-
WesterndigitalMy Cloud Pr2100-
WesterndigitalMy Cloud Pr4100-
WesterndigitalWd Cloud-

Related Weaknesses (CWE)

CWE-287CWE-697

References

FAQ

What is CVE-2022-22990?

CVE-2022-22990 is a vulnerability with a CVSS score of 7.8 (HIGH). A limited authentication bypass vulnerability was discovered that could allow an attacker to achieve remote code execution and escalate privileges on the My Cloud devices. Addressed this vulnerability...

How severe is CVE-2022-22990?

CVE-2022-22990 has been rated HIGH with a CVSS base score of 7.8/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2022-22990?

Check the references section above for vendor advisories and patch information. Affected products include: Westerndigital My Cloud Os, Westerndigital My Cloud, Westerndigital My Cloud Dl2100, Westerndigital My Cloud Dl4100, Westerndigital My Cloud Ex2 Ultra.