CVE-2022-29844: falha de média gravidade em Western Digital My Cloud
Western Digital My Cloud OS 5 arbitrary file read and write vulnerability via ftp
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
25Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 6.7epss 36%
A vulnerability in the FTP service of Western Digital My Cloud OS 5 devices running firmware versions prior to 5.26.119 allows an attacker to read and write arbitrary files. This could lead to a full NAS compromise and would give remote execution capabilities to the attacker.
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Produtos afetados
Western Digital · My CloudCVEs relacionadas — Western Digital My Cloud
No mesmo produto, das mais perigosas para as menos.
CVE-2022-22995CRITICALWestern Digital My Cloud OS 5 and My Cloud Home Unauthenticated Arbitrary File Write Vulnerability in NetatalkEPSS 2.7%CVE-2022-22990HIGHLimited authentication bypass vulnerability on Western Digital My Cloud devicesEPSS 2.2%CVE-2022-22994HIGHInsufficient Verification of Data Authenticity Remote Code Execution Vulnerability on Western Digital My Cloud devices.EPSS 1.9%CVE-2022-22989CRITICALPre-authenticated stack overflow vulnerability on FTP ServiceEPSS 1.4%CVE-2022-22991HIGHCommand injection through unsecured HTTP calls on Western Digital My Cloud devicesEPSS 1.3%CVE-2022-29843MEDIUMWestern Digital My Cloud OS 5 devices Command Injection VulnerabilityEPSS 1.2%