TI-2024-14769 Aliases CVE-2024-22169 GHSA-cqcg-4g39-cjvj

Misconfiguration in node.js causing a code execution in WD Discovery

LOW 33CWE-94Published 2024-08-02 · Updated 2024-08-05

Key facts

Attack vector: Local
Privileges required: None
User interaction: Passive
Attack complexity: Low
Attack requirements: Present
Impact type: Code execution
Confidentiality · integrity · availability: None · High · None
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-94.

Summary

WD Discovery versions prior to 5.0.589 contain a misconfiguration in the Node.js environment settings that could allow code execution by utilizing the 'ELECTRON_RUN_AS_NODE' environment variable. Any malicious application operating with standard user permissions can exploit this vulnerability, enabling code execution within WD Discovery application's context. WD Discovery version 5.0.589 addresses this issue by disabling certain features and fuses in Electron. The attack vector for this issue requires the victim to have the WD Discovery app installed on their device.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00259 17th percentileScored 2026-11-07

Fix Fixed WD Discovery (Western Digital): 5.0.589

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Western Digital	WD Discovery	before 5.0.589	5.0.589	Patch available	CNA

WD Discovery VendorWestern Digital Affected before 5.0.589 Fixed in 5.0.589 Patch available CNA

CPE names CISA-ADP · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:westerndigital:wd_discovery:-:::::mac_os::	not specified by CISA-ADP	—	Westerndigital

cpe:2.3:a:westerndigital:wd_discovery:-:*:*:*:*:mac_os:*:* Versions not specified by CISA-ADP — ·Westerndigital

Remediation

Fix · CNA WD Discovery (Western Digital) Fixed in 5.0.589

Timeline

2026-10-02 Threatist record created from CVE-2024-22169
2026-10-03 Alias added: GHSA-cqcg-4g39-cjvj

References

Other 1

https://www.westerndigital.com/support/product-security/wdc-24004-wd-discovery-desktop-app-version-5-0-589

TI-2016-08187 Unauthenticated Remote Command injection as root occurs in the Western Digital MyCloud… CVSS 3.0CRITICAL 9.8
TI-2018-12259 It was discovered that the Western Digital My Cloud device before 2.30.196 is affected by… CVSS 3.0CRITICAL 9.8
TI-2022-12204 Western Digital My Cloud OS 5 arbitrary file read and write vulnerability via ftp CVSS 3.1CRITICAL 9.8
TI-2016-08186 Unauthenticated Remote Command injection as root occurs in the Western Digital MyCloud… CVSS 3.0CRITICAL 9.8
TI-2018-01067 Memory corruption in Western Digital TV Media Player CVSS 3.0CRITICAL 9.8
TI-2022-12202 Command Injection Vulnerability in Western Digital My Cloud devices CVSS 3.1CRITICAL 9.8

See all 52 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences