Command Injection Vulnerability on My Cloud Home
Priority MEDIUM 45CWE-78Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-78.
Summary
Addressed a remote code execution vulnerability by resolving a command injection vulnerability and closing an AWS S3 bucket that potentially allowed an attacker to execute unsigned code on My Cloud Home devices.
Why it matters now
EPSS 0.0151 74th percentileScored 2026-11-07
Fix Fixed My Cloud Home (Western Digital): 8.5.1-102
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Western Digital | My Cloud Home | My Cloud Home Firmware to before 8.5.1-102 | 8.5.1-102 | Patch available | CNA |
- My Cloud Home VendorWestern Digital Affected My Cloud Home Firmware to before 8.5.1-102 Fixed in 8.5.1-102 Patch available CNA
CPE configurations NVD · 5
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:westerndigital:my_cloud_home_duo_firmware:*:*:*:*:*:*:*:* | before 8.5.1-102 | Vulnerable | Westerndigital |
| cpe:2.3:h:westerndigital:my_cloud_home_duo:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Westerndigital |
| cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Linux |
| cpe:2.3:o:westerndigital:my_cloud_home_firmware:*:*:*:*:*:*:*:* | before 8.5.1-102 | Vulnerable | Westerndigital |
| cpe:2.3:h:westerndigital:my_cloud_home:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Westerndigital |
- cpe:2.3:o:westerndigital:my_cloud_home_duo_firmware:*:*:*:*:*:*:*:* Versions before 8.5.1-102 Vulnerable ·Westerndigital
- cpe:2.3:h:westerndigital:my_cloud_home_duo:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Westerndigital
- cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Linux
- cpe:2.3:o:westerndigital:my_cloud_home_firmware:*:*:*:*:*:*:*:* Versions before 8.5.1-102 Vulnerable ·Westerndigital
- cpe:2.3:h:westerndigital:my_cloud_home:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Westerndigital
Remediation
- Fix · CNA My Cloud Home (Western Digital) Fixed in 8.5.1-102
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
Western Digital My Cloud Home 8.5.1-102
2 records Highest priority Priority MEDIUM 1 MEDIUM, 1 LOW
Other records, highest priority first
- TI-2022-07173 Protecting AWS credentials stored in plaintext on My Cloud HomePriority LOW 36
Timeline
- 2026-10-02 Threatist record created from CVE-2022-22997
- 2026-10-03 Alias added: GHSA-mj6h-crq2-hr82
References
More Western Digital vulnerabilities
- TI-2016-08187 Unauthenticated Remote Command injection as root occurs in the Western Digital MyCloud… CVSS 3.0CRITICAL 9.8
- TI-2018-12259 It was discovered that the Western Digital My Cloud device before 2.30.196 is affected by… CVSS 3.0CRITICAL 9.8
- TI-2022-12204 Western Digital My Cloud OS 5 arbitrary file read and write vulnerability via ftp CVSS 3.1CRITICAL 9.8
- TI-2016-08186 Unauthenticated Remote Command injection as root occurs in the Western Digital MyCloud… CVSS 3.0CRITICAL 9.8
- TI-2018-01067 Memory corruption in Western Digital TV Media Player CVSS 3.0CRITICAL 9.8
- TI-2022-12202 Command Injection Vulnerability in Western Digital My Cloud devices CVSS 3.1CRITICAL 9.8
Sources
- CVE-2022-22997 · CVE Program
- CVE-2022-22997 · NVD
- FIRST EPSS
- GHSA-mj6h-crq2-hr82 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences