Lucene search

WDC PSIRTCVE-2022-29839

HistoryDec 09, 2022 - 6:15 p.m.

CVE-2022-29839

2022-12-0918:15:18

CWE-522

WDC PSIRT

web.nvd.nist.gov

cve-2022-29839

insufficiently protected credentials

vulnerability

remote backups

data security

western digital my cloud

CVSS3

5.5

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

AI Score

6.2

Confidence

High

EPSS

Percentile

12.7%

JSON

Insufficiently Protected Credentials vulnerability in the remote backups application on Western Digital My Cloud devices that could allow an attacker who has gained access to a relevant endpoint to use that information to access protected data. This issue affects: Western Digital My Cloud My Cloud versions prior to 5.25.124 on Linux.

Affected configurations

Nvd

Node

westerndigitalmy_cloudMatch-

westerndigitalmy_cloud_dl2100Match-

westerndigitalmy_cloud_dl4100Match-

westerndigitalmy_cloud_ex2_ultraMatch-

westerndigitalmy_cloud_ex2100Match-

westerndigitalmy_cloud_ex4100Match-

westerndigitalmy_cloud_mirror_g2Match-

westerndigitalmy_cloud_pr2100Match-

westerndigitalmy_cloud_pr4100Match-

westerndigitalwd_cloudMatch-

linuxlinux_kernelMatch-

AND

westerndigitalmy_cloud_osRange<5.25.124

VendorProductVersionCPE
westerndigitalmy_cloud-cpe:2.3:h:westerndigital:my_cloud:-:*:*:*:*:*:*:*
westerndigitalmy_cloud_dl2100-cpe:2.3:h:westerndigital:my_cloud_dl2100:-:*:*:*:*:*:*:*
westerndigitalmy_cloud_dl4100-cpe:2.3:h:westerndigital:my_cloud_dl4100:-:*:*:*:*:*:*:*
westerndigitalmy_cloud_ex2_ultra-cpe:2.3:h:westerndigital:my_cloud_ex2_ultra:-:*:*:*:*:*:*:*
westerndigitalmy_cloud_ex2100-cpe:2.3:h:westerndigital:my_cloud_ex2100:-:*:*:*:*:*:*:*
westerndigitalmy_cloud_ex4100-cpe:2.3:h:westerndigital:my_cloud_ex4100:-:*:*:*:*:*:*:*
westerndigitalmy_cloud_mirror_g2-cpe:2.3:h:westerndigital:my_cloud_mirror_g2:-:*:*:*:*:*:*:*
westerndigitalmy_cloud_pr2100-cpe:2.3:h:westerndigital:my_cloud_pr2100:-:*:*:*:*:*:*:*
westerndigitalmy_cloud_pr4100-cpe:2.3:h:westerndigital:my_cloud_pr4100:-:*:*:*:*:*:*:*
westerndigitalwd_cloud-cpe:2.3:h:westerndigital:wd_cloud:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
westerndigital	my_cloud	-	cpe:2.3:h:westerndigital:my_cloud:-:::::::*
westerndigital	my_cloud_dl2100	-	cpe:2.3:h:westerndigital:my_cloud_dl2100:-:::::::*
westerndigital	my_cloud_dl4100	-	cpe:2.3:h:westerndigital:my_cloud_dl4100:-:::::::*
westerndigital	my_cloud_ex2_ultra	-	cpe:2.3:h:westerndigital:my_cloud_ex2_ultra:-:::::::*
westerndigital	my_cloud_ex2100	-	cpe:2.3:h:westerndigital:my_cloud_ex2100:-:::::::*
westerndigital	my_cloud_ex4100	-	cpe:2.3:h:westerndigital:my_cloud_ex4100:-:::::::*
westerndigital	my_cloud_mirror_g2	-	cpe:2.3:h:westerndigital:my_cloud_mirror_g2:-:::::::*
westerndigital	my_cloud_pr2100	-	cpe:2.3:h:westerndigital:my_cloud_pr2100:-:::::::*
westerndigital	my_cloud_pr4100	-	cpe:2.3:h:westerndigital:my_cloud_pr4100:-:::::::*
westerndigital	wd_cloud	-	cpe:2.3:h:westerndigital:wd_cloud:-:::::::*

Rows per page:

1-10 of 121

CNA Affected

[
  {
    "vendor": "Western Digital",
    "product": "My Cloud",
    "versions": [
      {
        "version": "My Cloud",
        "status": "affected",
        "lessThan": "5.25.124",
        "versionType": "custom"
      }
    ],
    "platforms": [
      "Linux"
    ]
  }
]

References

www.westerndigital.com/support/product-security/wdc-22019-my-cloud-firmware-version-5-25-124

CVSS3

5.5

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

AI Score

6.2

Confidence

High

EPSS

Percentile

12.7%

JSON

Related for CVE-2022-29839