TI-2022-12195 Aliases CVE-2022-29835 GHSA-89v6-g7j9-xj43

WD Discovery's Use of Weak Hashing Algorithm for Code Signing

LOW 23CWE-328Published 2022-09-19 · Updated 2024-08-03

Key facts

Attack vector: Network
Privileges required: None
User interaction: Required
Attack complexity: High
Impact type: Information disclosure
Confidentiality · integrity · availability: High · None · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-326.

Summary

WD Discovery software executable files were signed with an unsafe SHA-1 hashing algorithm. An attacker could use this weakness to create forged certificate signatures due to the use of a hashing algorithm that is not collision-free. This could thereby impact the confidentiality of user content. This issue affects: Western Digital WD Discovery WD Discovery Desktop App versions prior to 4.4.396 on Mac; WD Discovery Desktop App versions prior to 4.4.396 on Windows.

Why it matters now

EPSS 0.00199 9th percentileScored 2026-11-07

Fix Fixed WD Discovery (Western Digital): 4.4.396

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Western Digital	WD Discovery	WD Discovery Desktop App to before 4.4.396	4.4.396	Patch available	CNA
Western Digital	WD Discovery	WD Discovery Desktop App to before 4.4.396	4.4.396	Patch available	CNA

WD Discovery VendorWestern Digital Affected WD Discovery Desktop App to before 4.4.396 Fixed in 4.4.396 Patch available CNA
WD Discovery VendorWestern Digital Affected WD Discovery Desktop App to before 4.4.396 Fixed in 4.4.396 Patch available CNA

CPE configurations NVD · 2

CPE	Versions	Role	Vendor
cpe:2.3:a:westerndigital:wd_discovery::::::macos::*	before 4.4.396	Vulnerable	Westerndigital
cpe:2.3:a:westerndigital:wd_discovery::::::windows::*	before 4.4.396	Vulnerable	Westerndigital

cpe:2.3:a:westerndigital:wd_discovery:*:*:*:*:*:macos:*:* Versions before 4.4.396 Vulnerable ·Westerndigital
cpe:2.3:a:westerndigital:wd_discovery:*:*:*:*:*:windows:*:* Versions before 4.4.396 Vulnerable ·Westerndigital

Remediation

Fix · CNA WD Discovery (Western Digital) Fixed in 4.4.396
Fix · CNA WD Discovery (Western Digital) Fixed in 4.4.396

Timeline

2026-10-02 Threatist record created from CVE-2022-29835
2026-10-03 Alias added: GHSA-89v6-g7j9-xj43

References

Advisory 1

https://www.westerndigital.com/support/product-security/wdc-22014-wd-discovery-desktop-app-version-4-4-396

TI-2016-08187 Unauthenticated Remote Command injection as root occurs in the Western Digital MyCloud… CVSS 3.0CRITICAL 9.8
TI-2018-12259 It was discovered that the Western Digital My Cloud device before 2.30.196 is affected by… CVSS 3.0CRITICAL 9.8
TI-2022-12204 Western Digital My Cloud OS 5 arbitrary file read and write vulnerability via ftp CVSS 3.1CRITICAL 9.8
TI-2016-08186 Unauthenticated Remote Command injection as root occurs in the Western Digital MyCloud… CVSS 3.0CRITICAL 9.8
TI-2018-01067 Memory corruption in Western Digital TV Media Player CVSS 3.0CRITICAL 9.8
TI-2022-12202 Command Injection Vulnerability in Western Digital My Cloud devices CVSS 3.1CRITICAL 9.8

See all 52 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences