CVE-2022-23000

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

The Western Digital My Cloud Web App [https://os5.mycloud.com/] uses a weak SSLContext when attempting to configure port forwarding rules. This was enabled to maintain compatibility with old or outdated home routers. By using an "SSL" context instead of "TLS" or specifying stronger validation, deprecated or insecure protocols are permitted. As a result, a local user with no privileges can exploit this vulnerability and jeopardize the integrity, confidentiality and authenticity of information transmitted. The scope of impact cannot extend to other components and no user input is required to exploit this vulnerability.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-757

Affected software

No affected versions have been published.

Timeline

Published
Jul 25, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-230015.3When compressing or decompressing elliptic curve points using the Sweet B library, an incorrect choice of sign bit is used. An attacker withCVE-2022-230025.3When compressing or decompressing a point on the NIST P-256 elliptic curve with an X coordinate of zero, the resulting output is not properlCVE-2022-230035.3When computing a shared secret or point multiplication on the NIST P-256 curve that results in an X coordinate of zero, the resulting outputCVE-2022-230045.3When computing a shared secret or point multiplication on the NIST P-256 curve using a public key with an X coordinate of zero, an error is CVE-2022-230058.7Western Digital has identified a weakness in the UFS standard that could result in a security vulnerability. This vulnerability may exist inCVE-2022-230066.7A stack-based buffer overflow vulnerability was found on Western Digital My Cloud Home, My Cloud Home Duo, and SanDisk ibi that could allow CVE-2022-230085.4On NGINX Controller API Management versions 3.18.0-3.19.0, an authenticated attacker with access to the "user" or "admin" role can use undisCVE-2022-230097.2On BIG-IQ Centralized Management 8.x before 8.1.0, an authenticated administrative role user on a BIG-IQ managed BIG-IP device can access otCVE-2022-23015.5Buffer Over-read in GitHub repository hpjansson/chafa prior to 1.10.3.CVE-2022-230107.5On BIG-IP versions 16.x before 16.1.0, 15.1.x before 15.1.4.1, 14.1.x before 14.1.4.4, and all versions of 13.1.x, 12.1.x, and 11.6.x, when CVE-2022-230117.5On certain hardware BIG-IP platforms, in version 15.1.x before 15.1.4 and 14.1.x before 14.1.3, virtual servers may stop responding while prCVE-2022-230127.5On BIG-IP versions 15.1.x before 15.1.4.1 and 14.1.x before 14.1.4.5, when the HTTP/2 profile is configured on a virtual server, undisclosed