CVE-2023-22816

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

A post-authentication remote command injection vulnerability in a CGI file in Western Digital My Cloud OS 5 devices that could allow an attacker to build files with redirects and execute larger payloads. This issue affects My Cloud OS 5 devices: before 5.26.300.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78 CWE-77

Affected software

No affected versions have been published.

Timeline

Published: Jun 30, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-228175.5Server-side request forgery (SSRF) vulnerability that could allow a rogue server on the local network to modify its URL using another DNS ad CVE-2023-228187.8Multiple DLL Search Order Hijack vulnerabilities were addressed in the SanDisk Security Installer for Windows that could allow attackers wit CVE-2023-228194.9An uncontrolled resource consumption vulnerability issue that could arise by sending crafted requests to a service to consume a large amount CVE-2023-22826.5Improper access control in the Web Login listener in Devolutions Remote Desktop Manager 2023.1.22 and earlier on Windows allows an authentic CVE-2023-22836.5A vulnerability was found in libssh, where the authentication check of the connecting client can be bypassed in the`pki_verify_data_signatur CVE-2023-228327.5The ExtractCCDAAttributes Processor in Apache NiFi 1.2.0 through 1.19.1 does not restrict XML External Entity references. Flow configuratio CVE-2023-228336.5Palantir Foundry deployments running Lime2 versions between 2.519.0 and 2.532.0 were vulnerable a bug that allowed authenticated users withi CVE-2023-228344.3The Contour Service was not checking that users had permission to create an analysis for a given dataset. This could allow an attacker to cl CVE-2023-228357.7A security defect was identified that enabled a user of Foundry Issues to perform a Denial of Service attack by submitting malformed data in CVE-2023-228365.4In cases where a multi-tenant stack user is operating Foundry’s Linter service, and the user changes a group name from the default value, th CVE-2023-228385.4Cross-site scripting vulnerability in Product List Screen and Product Detail Screen of EC-CUBE 4.0.0 to 4.0.6-p2, EC-CUBE 4.1.0 to 4.1.2-p1,CVE-2023-228397.5On BIG-IP versions 17.0.x before 17.0.0.2, 16.1.x before 16.1.3.3, 15.1.x before 15.1.8.1, 14.1.x before 14.1.5.3, and all version of 13.1.x