Vulnerability Description
Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability that could allow an attacker to execute code in the context of the root user on a vulnerable CGI file was discovered in Western Digital My Cloud OS 5 devicesThis issue affects My Cloud OS 5: before 5.26.119.
CVSS Score
CRITICAL
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Westerndigital | My Cloud Os | >= 5.02.104, < 5.26.119 |
| Westerndigital | My Cloud | - |
| Westerndigital | My Cloud Dl2100 | - |
| Westerndigital | My Cloud Dl4100 | - |
| Westerndigital | My Cloud Ex2 Ultra | - |
| Westerndigital | My Cloud Ex2100 | - |
| Westerndigital | My Cloud Ex4100 | - |
| Westerndigital | My Cloud Mirror G2 | - |
| Westerndigital | My Cloud Pr2100 | - |
| Westerndigital | My Cloud Pr4100 | - |
| Westerndigital | Wd Cloud | - |
Related Weaknesses (CWE)
References
- https://www.westerndigital.com/support/product-security/wdc-23002-my-cloud-firmwVendor Advisory
- https://www.westerndigital.com/support/product-security/wdc-23002-my-cloud-firmwVendor Advisory
FAQ
What is CVE-2022-29842?
CVE-2022-29842 is a vulnerability with a CVSS score of 9.8 (CRITICAL). Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability that could allow an attacker to execute code in the context of the root user on a vulnerable CGI file ...
How severe is CVE-2022-29842?
CVE-2022-29842 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2022-29842?
Check the references section above for vendor advisories and patch information. Affected products include: Westerndigital My Cloud Os, Westerndigital My Cloud, Westerndigital My Cloud Dl2100, Westerndigital My Cloud Dl4100, Westerndigital My Cloud Ex2 Ultra.