Critical severity · published Jan 13, 2022
CVE-2022-22989
My Cloud OS 5 was vulnerable to a pre-authenticated stack overflow vulnerability on the FTP service that could be exploited by unauthenticated attackers on the network
9.8
CVSS
1.3%
EPSS
No
On KEV
Description
My Cloud OS 5 was vulnerable to a pre-authenticated stack overflow vulnerability on the FTP service that could be exploited by unauthenticated attackers on the network. Addressed the vulnerability by adding defenses against stack overflow issues.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.3% · higher than 71% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MC
MY Cloud OS · Westerndigital
before 5.19.117 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-22989
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-22989
Vendor Advisory
https://www.westerndigital.com/support/product-security/wdc-22002-my-cloud-os5-firmware-5-19-117
More from MY Cloud OS
9.8
CVE-2023-22814
Authentication Bypass issue in My Cloud OS 5 devices
9.8
CVE-2022-29841
OS Command Injection vulnerability in Western Digital My Cloud devices
9.8
CVE-2022-29842
Command Injection Vulnerability in Western Digital My Cloud devices
9.8
CVE-2021-36226
Western Digital My Cloud devices before OS5 do not use cryptographically signed Firmware upgrade files
9.8
CVE-2021-36224
Western Digital My Cloud devices before OS5 have a nobody account with a blank password