Limited authentication bypass vulnerability on Western Digital My Cloud devices
Priority MEDIUM 42CWE-287Published · Updated
Key facts
- Attack vector
- Adjacent network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-287.
Summary
A limited authentication bypass vulnerability was discovered that could allow an attacker to achieve remote code execution and escalate privileges on the My Cloud devices. Addressed this vulnerability by changing access token validation logic and rewriting rule logic on PHP scripts.
Why it matters now
EPSS 0.02194 82nd percentileScored 2026-11-07
Fix Fixed My Cloud (Western Digital): 5.19.117
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Western Digital | My Cloud | My Cloud OS 5 to before 5.19.117 | 5.19.117 | Patch available | CNA |
- My Cloud VendorWestern Digital Affected My Cloud OS 5 to before 5.19.117 Fixed in 5.19.117 Patch available CNA
CPE configurations NVD · 11
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:westerndigital:my_cloud_os:*:*:*:*:*:*:*:* | before 5.19.117 | Vulnerable | Westerndigital |
| cpe:2.3:h:westerndigital:my_cloud:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Westerndigital |
| cpe:2.3:h:westerndigital:my_cloud_dl2100:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Westerndigital |
| cpe:2.3:h:westerndigital:my_cloud_dl4100:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Westerndigital |
| cpe:2.3:h:westerndigital:my_cloud_ex2_ultra:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Westerndigital |
| cpe:2.3:h:westerndigital:my_cloud_ex2100:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Westerndigital |
| cpe:2.3:h:westerndigital:my_cloud_ex4100:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Westerndigital |
| cpe:2.3:h:westerndigital:my_cloud_mirror_gen_2:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Westerndigital |
| cpe:2.3:h:westerndigital:my_cloud_pr2100:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Westerndigital |
| cpe:2.3:h:westerndigital:my_cloud_pr4100:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Westerndigital |
- cpe:2.3:o:westerndigital:my_cloud_os:*:*:*:*:*:*:*:* Versions before 5.19.117 Vulnerable ·Westerndigital
- cpe:2.3:h:westerndigital:my_cloud:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Westerndigital
- cpe:2.3:h:westerndigital:my_cloud_dl2100:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Westerndigital
- cpe:2.3:h:westerndigital:my_cloud_dl4100:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Westerndigital
- cpe:2.3:h:westerndigital:my_cloud_ex2_ultra:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Westerndigital
- cpe:2.3:h:westerndigital:my_cloud_ex2100:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Westerndigital
- cpe:2.3:h:westerndigital:my_cloud_ex4100:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Westerndigital
- cpe:2.3:h:westerndigital:my_cloud_mirror_gen_2:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Westerndigital
- cpe:2.3:h:westerndigital:my_cloud_pr2100:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Westerndigital
- cpe:2.3:h:westerndigital:my_cloud_pr4100:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Westerndigital
Show 1 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:h:westerndigital:wd_cloud:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Westerndigital |
- cpe:2.3:h:westerndigital:wd_cloud:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Westerndigital
Remediation
- Fix · CNA My Cloud (Western Digital) Fixed in 5.19.117
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
Western Digital My Cloud 5.19.117
3 records Highest priority Priority MEDIUM 3 MEDIUM
Other records, highest priority first
- TI-2022-07164 Pre-authenticated stack overflow vulnerability on FTP ServicePriority MEDIUM 45
- TI-2022-07166 Command injection through unsecured HTTP calls on Western Digital My Cloud devicesPriority MEDIUM 41
Timeline
- 2026-10-02 Threatist record created from CVE-2022-22990
- 2026-10-03 Alias added: GHSA-qqqv-wfvc-wrgw
References
More Western Digital vulnerabilities
- TI-2016-08187 Unauthenticated Remote Command injection as root occurs in the Western Digital MyCloud… CVSS 3.0CRITICAL 9.8
- TI-2018-12259 It was discovered that the Western Digital My Cloud device before 2.30.196 is affected by… CVSS 3.0CRITICAL 9.8
- TI-2022-12204 Western Digital My Cloud OS 5 arbitrary file read and write vulnerability via ftp CVSS 3.1CRITICAL 9.8
- TI-2016-08186 Unauthenticated Remote Command injection as root occurs in the Western Digital MyCloud… CVSS 3.0CRITICAL 9.8
- TI-2018-01067 Memory corruption in Western Digital TV Media Player CVSS 3.0CRITICAL 9.8
- TI-2022-12202 Command Injection Vulnerability in Western Digital My Cloud devices CVSS 3.1CRITICAL 9.8
Sources
- CVE-2022-22990 · CVE Program
- CVE-2022-22990 · NVD
- FIRST EPSS
- GHSA-qqqv-wfvc-wrgw · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences