1. Home
  2. CVE Database
  3. CVE-2022-22992
HIGH · 7.8

CVE-2022-22992

A command injection remote code execution vulnerability was discovered on Western Digital My Cloud Devices that could allow an attacker to execute arbitrary system commands on the device. The vulnerab...

Vulnerability Description

A command injection remote code execution vulnerability was discovered on Western Digital My Cloud Devices that could allow an attacker to execute arbitrary system commands on the device. The vulnerability was addressed by escaping individual arguments to shell functions coming from user input.

CVSS Score

7.8

HIGH

CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N
Attack Vector
LOCAL
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
NONE
Scope
CHANGED
Confidentiality
HIGH
Integrity
HIGH
Availability
NONE

Affected Products

VendorProductVersions
WesterndigitalMy Cloud Os< 5.19.117
WesterndigitalMy Cloud-
WesterndigitalMy Cloud Dl2100-
WesterndigitalMy Cloud Dl4100-
WesterndigitalMy Cloud Ex2 Ultra-
WesterndigitalMy Cloud Ex2100-
WesterndigitalMy Cloud Ex4100-
WesterndigitalMy Cloud Mirror Gen 2-
WesterndigitalMy Cloud Pr2100-
WesterndigitalMy Cloud Pr4100-
WesterndigitalWd Cloud-

Related Weaknesses (CWE)

CWE-116

References

FAQ

What is CVE-2022-22992?

CVE-2022-22992 is a vulnerability with a CVSS score of 7.8 (HIGH). A command injection remote code execution vulnerability was discovered on Western Digital My Cloud Devices that could allow an attacker to execute arbitrary system commands on the device. The vulnerab...

How severe is CVE-2022-22992?

CVE-2022-22992 has been rated HIGH with a CVSS base score of 7.8/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2022-22992?

Check the references section above for vendor advisories and patch information. Affected products include: Westerndigital My Cloud Os, Westerndigital My Cloud, Westerndigital My Cloud Dl2100, Westerndigital My Cloud Dl4100, Westerndigital My Cloud Ex2 Ultra.