Medium severity · published Dec 9, 2022
CVE-2022-29838
Authentication issue with the encrypted volumes and auto mount feature in My Cloud devices
4.6
CVSS
0.3%
EPSS
No
On KEV
Description
Improper Authentication vulnerability in the encrypted volumes and auto mount features of Western Digital My Cloud devices allows insecure direct access to the drive information in the case of a device reset. This issue affects: Western Digital My Cloud My Cloud versions prior to 5.25.124 on Linux.
CVSS vector
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Physical
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 19% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MC
My Cloud · Western Digital
My Cloud before 5.25.124 · source: vendor
MC
MY Cloud OS · Westerndigital
before 5.25.124 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-29838
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-29838
Vendor Advisory
https://www.westerndigital.com/support/product-security/wdc-22019-my-cloud-firmware-version-5-25-124
More from My Cloud
9.8
CVE-2022-29843
Western Digital My Cloud OS 5 devices Command Injection Vulnerability
9.8
CVE-2022-29844
Western Digital My Cloud OS 5 arbitrary file read and write vulnerability via ftp
9.3
CVE-2025-30247
An OS command injection vulnerability in user interface in Western Digital My Cloud firmware prior to 5.31.108 on NAS platforms allows remote attackers to execute arbitrary system…
9.2
CVE-2024-22170
Unchecked buffer in Dynamic DNS client
7.8
CVE-2022-23000
Weak Default SSL use in Port Forwarding Service