CVE-2022-22991

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

A malicious user on the same LAN could use DNS spoofing followed by a command injection attack to trick a NAS device into loading through an unsecured HTTP call. Addressed this vulnerability by disabling checks for internet connectivity using HTTP.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78 CWE-77

Affected software

No affected versions have been published.

Timeline

Published: Jan 13, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-229929.8A command injection remote code execution vulnerability was discovered on Western Digital My Cloud Devices that could allow an attacker to e CVE-2022-229938.8A limited SSRF vulnerability was discovered on Western Digital My Cloud devices that could allow an attacker to impersonate a server and rea CVE-2022-229949.8A remote code execution vulnerability was discovered on Western Digital My Cloud devices where an attacker could trick a NAS device into loa CVE-2022-229959.8The combination of primitives offered by SMB and AFP in their default configuration allows the arbitrary writing of files. By exploiting the CVE-2022-229967.8The G-RAID 4/8 Software Utility setups for Windows were affected by a DLL hijacking vulnerability. Successful exploitation could lead to arb CVE-2022-229979.8Addressed a remote code execution vulnerability by resolving a command injection vulnerability and closing an AWS S3 bucket that potentially CVE-2022-229987.5Implemented protections on AWS credentials that were not properly protected.CVE-2022-229994.8Western Digital My Cloud devices are vulnerable to a cross side scripting vulnerability that can allow a malicious user with elevated privil CVE-2022-23005.4Cross-site Scripting (XSS) - Stored in GitHub repository microweber/microweber prior to 1.2.19.CVE-2022-230007.8The Western Digital My Cloud Web App [https://os5.mycloud.com/] uses a weak SSLContext when attempting to configure port forwarding rules. T CVE-2022-230015.3When compressing or decompressing elliptic curve points using the Sweet B library, an incorrect choice of sign bit is used. An attacker with CVE-2022-230025.3When compressing or decompressing a point on the NIST P-256 elliptic curve with an X coordinate of zero, the resulting output is not properl