Medium severity · published Dec 9, 2022
CVE-2022-29838
Improper Authentication vulnerability in the encrypted volumes and auto mount features of Western Digital My Cloud devices allows insecure direct access to the drive information…
4.6
CVSS
0.3%
EPSS
No
On KEV
Description
Improper Authentication vulnerability in the encrypted volumes and auto mount features of Western Digital My Cloud devices allows insecure direct access to the drive information in the case of a device reset. This issue affects: Western Digital My Cloud My Cloud versions prior to 5.25.124 on Linux.
CVSS vector
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Physical
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 19% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MC
MY Cloud OS · Westerndigital
before 5.25.124 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-29838
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-29838
Vendor Advisory
https://www.westerndigital.com/support/product-security/wdc-22019-my-cloud-firmware-version-5-25-124
More from MY Cloud OS
9.8
CVE-2023-22814
An authentication bypass issue via spoofing was discovered in the token-based authentication mechanism that could allow an attacker to carry out an impersonation attack
9.8
CVE-2022-29841
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability that was caused by a command that read files from a privileged location…
9.8
CVE-2022-29842
Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability that could allow an attacker to execute code in the context of the root user on a…
9.8
CVE-2021-36226
Western Digital My Cloud devices before OS5 do not use cryptographically signed Firmware upgrade files
9.8
CVE-2021-36224
Western Digital My Cloud devices before OS5 have a nobody account with a blank password