« Volver al listado

CVE-2022-22994

Estado: ModificadaCrítica (9.8)—

A remote code execution vulnerability was discovered on Western Digital My Cloud devices where an attacker could trick a NAS device into loading through an unsecured HTTP call. This was a result insufficient verification of calls to the device. The vulnerability was addressed by disabling checks for internet connectivity using HTTP.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Westerndigital — MY Cloud OS

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2022-22994",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 7.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "psirt@wdc.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 8.8,
          "attackVector": "ADJACENT_NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 2.8
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 9.8,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "psirt@wdc.com",
      "affectedData": [
        {
          "vendor": "Western Digital",
          "product": "My Cloud",
          "versions": [
            {
              "status": "affected",
              "version": "My Cloud OS 5",
              "lessThan": "5.19.117",
              "versionType": "custom"
            }
          ]
        }
      ]
    }
  ],
  "published": "2022-01-28T20:15:12.813",
  "references": [
    {
      "url": "https://www.westerndigital.com/support/product-security/wdc-22002-my-cloud-os5-firmware-5-19-117",
      "tags": [
        "Release Notes",
        "Vendor Advisory"
      ],
      "source": "psirt@wdc.com"
    },
    {
      "url": "https://www.zerodayinitiative.com/advisories/ZDI-22-349/",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "psirt@wdc.com"
    },
    {
      "url": "https://www.westerndigital.com/support/product-security/wdc-22002-my-cloud-os5-firmware-5-19-117",
      "tags": [
        "Release Notes",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.zerodayinitiative.com/advisories/ZDI-22-349/",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "psirt@wdc.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-345"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-345"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "A remote code execution vulnerability was discovered on Western Digital My Cloud devices where an attacker could trick a NAS device into loading through an unsecured HTTP call. This was a result insufficient verification of calls to the device. The vulnerability was addressed by disabling checks for internet connectivity using HTTP."
    },
    {
      "lang": "es",
      "value": "Se ha detectado una vulnerabilidad de ejecución de código remota en los dispositivos My Cloud de Western Digital donde un atacante podía engañar a un dispositivo NAS para cargar mediante una llamada HTTP no segura. Esto era el resultado de una verificación insuficiente de las llamadas al dispositivo. La vulnerabilidad fue abordada al deshabilitar la comprobación de la conectividad a Internet mediante HTTP"
    }
  ],
  "lastModified": "2026-06-17T04:29:18.830",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:westerndigital:my_cloud_os:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9B585AE9-1F28-42D7-B16D-75BF1CB8A054",
              "versionEndExcluding": "5.19.117"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:westerndigital:my_cloud:-:*:*:*:-:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "F597DB20-7E49-4234-AB58-B944E6D3F9EA"
            },
            {
              "criteria": "cpe:2.3:h:westerndigital:my_cloud_dl2100:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "9E783EBC-7608-4527-B1AD-9B4E7A7A108C"
            },
            {
              "criteria": "cpe:2.3:h:westerndigital:my_cloud_dl4100:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "F3034F4A-239C-4E38-9BD6-217361A7C519"
            },
            {
              "criteria": "cpe:2.3:h:westerndigital:my_cloud_ex2_ultra:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "5A581EBA-A1F2-4ABC-8183-29973A46FA43"
            },
            {
              "criteria": "cpe:2.3:h:westerndigital:my_cloud_ex2100:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "ABBBDC1E-2320-4767-B669-1BB2FFB1E1C4"
            },
            {
              "criteria": "cpe:2.3:h:westerndigital:my_cloud_ex4100:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "B78030F0-6655-4604-9D16-2FA1F3FD52FF"
            },
            {
              "criteria": "cpe:2.3:h:westerndigital:my_cloud_mirror_gen_2:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "5695E842-1561-4A4F-901F-6EC07F558989"
            },
            {
              "criteria": "cpe:2.3:h:westerndigital:my_cloud_pr2100:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "BF58260B-2131-402C-A9DA-67B188136DE1"
            },
            {
              "criteria": "cpe:2.3:h:westerndigital:my_cloud_pr4100:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "CB0C2FD9-4792-4DA2-9698-E53109A499EC"
            },
            {
              "criteria": "cpe:2.3:h:westerndigital:wd_cloud:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "8FDE0337-4329-4CE3-9B0B-61BE8361E910"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "sourceIdentifier": "psirt@wdc.com"
}