CVE-2022-22990

HIGH

Western Digital My Cloud OS < 5.19.117 - Authentication Bypass and Remote Code Execution via Access Token Validation

Title source: llm
STIX 2.1

Description

A limited authentication bypass vulnerability was discovered that could allow an attacker to achieve remote code execution and escalate privileges on the My Cloud devices. Addressed this vulnerability by changing access token validation logic and rewriting rule logic on PHP scripts.

References (3)

Core 3
Core References
Third Party Advisory, VDB Entry x_refsource_misc
https://www.zerodayinitiative.com/advisories/ZDI-22-076/
Third Party Advisory, VDB Entry x_refsource_misc
https://www.zerodayinitiative.com/advisories/ZDI-22-347/

Scores

CVSS v3 7.8
EPSS 0.0212
EPSS Percentile 79.4%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N

Details

CWE
CWE-697 CWE-287
Status published
Products (1)
westerndigital/my_cloud_os < 5.19.117
Published Jan 13, 2022
Tracked Since Feb 18, 2026