Insecure file and directory permissions on EdgeRover
Priority MEDIUM 41CWE-275Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA.
Summary
File and directory permissions have been corrected to prevent unintended users from modifying or accessing resources. It would be more difficult for an authenticated attacker to now traverse through the files and directories. This can only be exploited once an attacker has already found a way to get authenticated access to the device.
Why it matters now
EPSS 0.00738 54th percentileScored 2026-11-07
Fix Fixed EdgeRover (Western Digital): 1.5.0-576
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Western Digital | EdgeRover | EdgeRover Mac Desktop App to before 1.5.0-576 | 1.5.0-576 | Patch available | CNA |
| Western Digital | EdgeRover | EdgeRover Windows Desktop App to before 1.5.0-576 | 1.5.0-576 | Patch available | CNA |
- EdgeRover VendorWestern Digital Affected EdgeRover Mac Desktop App to before 1.5.0-576 Fixed in 1.5.0-576 Patch available CNA
- EdgeRover VendorWestern Digital Affected EdgeRover Windows Desktop App to before 1.5.0-576 Fixed in 1.5.0-576 Patch available CNA
CPE configurations NVD · 2
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:westerndigital:edgerover:*:*:*:*:*:macos:*:* | before 1.5.0-576 | Vulnerable | Westerndigital |
| cpe:2.3:a:westerndigital:edgerover:*:*:*:*:*:windows:*:* | before 1.5.0-576 | Vulnerable | Westerndigital |
- cpe:2.3:a:westerndigital:edgerover:*:*:*:*:*:macos:*:* Versions before 1.5.0-576 Vulnerable ·Westerndigital
- cpe:2.3:a:westerndigital:edgerover:*:*:*:*:*:windows:*:* Versions before 1.5.0-576 Vulnerable ·Westerndigital
Remediation
- Fix · CNA EdgeRover (Western Digital) Fixed in 1.5.0-576
- Fix · CNA EdgeRover (Western Digital) Fixed in 1.5.0-576
Timeline
- 2026-10-02 Threatist record created from CVE-2022-22988
- 2026-10-03 Alias added: GHSA-gfrv-96fc-6fhx
References
More Western Digital vulnerabilities
- TI-2016-08187 Unauthenticated Remote Command injection as root occurs in the Western Digital MyCloud… CVSS 3.0CRITICAL 9.8
- TI-2018-12259 It was discovered that the Western Digital My Cloud device before 2.30.196 is affected by… CVSS 3.0CRITICAL 9.8
- TI-2022-12204 Western Digital My Cloud OS 5 arbitrary file read and write vulnerability via ftp CVSS 3.1CRITICAL 9.8
- TI-2016-08186 Unauthenticated Remote Command injection as root occurs in the Western Digital MyCloud… CVSS 3.0CRITICAL 9.8
- TI-2018-01067 Memory corruption in Western Digital TV Media Player CVSS 3.0CRITICAL 9.8
- TI-2022-12202 Command Injection Vulnerability in Western Digital My Cloud devices CVSS 3.1CRITICAL 9.8
Sources
- CVE-2022-22988 · CVE Program
- CVE-2022-22988 · NVD
- FIRST EPSS
- GHSA-gfrv-96fc-6fhx · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences