Critical severity · published Sep 27, 2024
CVE-2024-22170
Unchecked buffer in Dynamic DNS client
9.2
CVSS
0.5%
EPSS
No
On KEV
Description
Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in Western Digital My Cloud ddns-start on Linux allows Overflow Buffers.This issue affects My Cloud: before 5.29.102.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 40% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MC
My Cloud · Western Digital
before 5.29.102 · source: vendor
MC
MY Cloud Dl2100 Firmware · Westerndigital
before 5.29.102 · source: CISA
MC
MY Cloud Dl4100 Firmware · Westerndigital
before 5.29.102 · source: CISA
MC
MY Cloud Ex2 Ultra Firmware · Westerndigital
before 5.29.102 · source: CISA
MC
MY Cloud Ex2100 Firmware · Westerndigital
before 5.29.102 · source: CISA
MC
MY Cloud Ex4100 Firmware · Westerndigital
before 5.29.102 · source: CISA
MC
MY Cloud Firmware · Westerndigital
before 5.29.102 · source: CISA
MC
MY Cloud Mirror G2 Firmware · Westerndigital
before 5.29.102 · source: CISA
MC
MY Cloud Pr2100 Firmware · Westerndigital
before 5.29.102 · source: CISA
MC
MY Cloud Pr4100 Firmware · Westerndigital
before 5.29.102 · source: CISA
WC
WD Cloud Firmware · Westerndigital
before 5.29.102 · source: CISA
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-22170
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-22170
www.westerndigital.com
https://www.westerndigital.com/support/product-security/wdc-24005-western-digital-my-cloud-os-5-firmware-5-29-102
More from My Cloud
9.3
CVE-2025-30247
An OS command injection vulnerability in user interface in Western Digital My Cloud firmware prior to 5.31.108 on NAS platforms allows remote attackers to execute arbitrary system…