CVE-2022-22990

Katalog CVE

CVSS 8.8 · High EPSS 2,1%

Kerentanan Improper Authentication pada westerndigital my cloud os. Skor CVSS 3.1 8.8 (High) menurut NVD.

Deskripsi (NVD)

A limited authentication bypass vulnerability was discovered that could allow an attacker to achieve remote code execution and escalate privileges on the My Cloud devices. Addressed this vulnerability by changing access token validation logic and rewriting rule logic on PHP scripts.

Rincian

Terbit di NVD

13 Januari 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

8.8 (High), sumber NVD
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-287: Improper Authentication
CWE-697: Incorrect Comparison

EPSS (30 hari)

2,1% peluang dieksploitasi; lebih tinggi dari 81,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://www.westerndigital.com/support/product-security/wdc-22002-my-cloud-os5-firmware-5-19-117 advisory vendor
• https://www.zerodayinitiative.com/advisories/ZDI-22-076/ advisory pihak ketiga · vdb entry
• https://www.zerodayinitiative.com/advisories/ZDI-22-347/ advisory pihak ketiga · vdb entry