CVE-2022-22994: high-severity vulnerability in Western Digital My Cloud
Insufficient Verification of Data Authenticity Remote Code Execution Vulnerability on Western Digital My Cloud devices.
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
No sign of exploitation. No public exploitation artifact known so far.
Western Digital My Cloud devices can be tricked into executing malicious code remotely because they don't properly verify where commands are coming from. An attacker can send fake commands over the internet to take control of the device.
The vulnerability involves insufficient verification of data authenticity in update or communication mechanisms on My Cloud devices, allowing an attacker to inject malicious code through unsecured HTTP calls. Pre-condition: device must be accessible over the network or internet. Remediation involved disabling unverified HTTP connectivity checks to enforce proper authentication.
In the same product, most dangerous first.