CVE-2022-22990

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

A limited authentication bypass vulnerability was discovered that could allow an attacker to achieve remote code execution and escalate privileges on the My Cloud devices. Addressed this vulnerability by changing access token validation logic and rewriting rule logic on PHP scripts.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-287 CWE-697

Affected software

Vendor	Product	Versions
Western Digital	My Cloud	>= My Cloud OS 5, < 5.19.117

References

https://www.westerndigital.com/support/product-security/wdc-22002-my-cloud-os5-firmware-5-19-117Vendor Advisory
https://www.zerodayinitiative.com/advisories/ZDI-22-076/Third Party Advisory, VDB Entry
https://www.zerodayinitiative.com/advisories/ZDI-22-347/Third Party Advisory, VDB Entry
https://www.westerndigital.com/support/product-security/wdc-22002-my-cloud-os5-firmware-5-19-117Vendor Advisory
https://www.zerodayinitiative.com/advisories/ZDI-22-076/Third Party Advisory, VDB Entry
https://www.zerodayinitiative.com/advisories/ZDI-22-347/Third Party Advisory, VDB Entry

Timeline

Published: Jan 13, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-229918.8A malicious user on the same LAN could use DNS spoofing followed by a command injection attack to trick a NAS device into loading through an CVE-2022-229929.8A command injection remote code execution vulnerability was discovered on Western Digital My Cloud Devices that could allow an attacker to e CVE-2022-229938.8A limited SSRF vulnerability was discovered on Western Digital My Cloud devices that could allow an attacker to impersonate a server and rea CVE-2022-229949.8A remote code execution vulnerability was discovered on Western Digital My Cloud devices where an attacker could trick a NAS device into loa CVE-2022-229959.8The combination of primitives offered by SMB and AFP in their default configuration allows the arbitrary writing of files. By exploiting the CVE-2022-229967.8The G-RAID 4/8 Software Utility setups for Windows were affected by a DLL hijacking vulnerability. Successful exploitation could lead to arb CVE-2022-229979.8Addressed a remote code execution vulnerability by resolving a command injection vulnerability and closing an AWS S3 bucket that potentially CVE-2022-229987.5Implemented protections on AWS credentials that were not properly protected.CVE-2022-229994.8Western Digital My Cloud devices are vulnerable to a cross side scripting vulnerability that can allow a malicious user with elevated privil CVE-2022-23005.4Cross-site Scripting (XSS) - Stored in GitHub repository microweber/microweber prior to 1.2.19.CVE-2022-230007.8The Western Digital My Cloud Web App [https://os5.mycloud.com/] uses a weak SSLContext when attempting to configure port forwarding rules. T CVE-2022-230015.3When compressing or decompressing elliptic curve points using the Sweet B library, an incorrect choice of sign bit is used. An attacker with