by Kastro
Paper/Archive/CVE-2022-22997

CVE-2022-22997

Western Digital My Cloud Home — Command Injection Vulnerability on My Cloud Home

EPSS 2%CVSS 9.8
critical.is priorityof 100
44
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 74.4.744 × 2014.9No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

Addressed a remote code execution vulnerability by resolving a command injection vulnerability and closing an AWS S3 bucket that potentially allowed an attacker to execute unsigned code on My Cloud Home devices.

Affected

ProductAffectedFixed inSource
My Cloud HomeMy Cloud Home Firmware – < 8.5.1-1028.5.1-102CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
WDC PSIRT (CNA)6.8CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

References

refwesterndigital.com/support/product-security/wdc-22009-my-cloud-home-firmware-version-8-7-0-107