CVE-2022-22990CWE-287
Limited authentication bypass vulnerability on Western Digital My Cloud devices
High · published January 13, 2022
What it is
A limited authentication bypass vulnerability was discovered that could allow an attacker to achieve remote code execution and escalate privileges on the My Cloud devices. Addressed this vulnerability by changing access token validation logic and rewriting rule logic on PHP scripts.
The record
Technical detail
- CVSS v3.1
- 7.8 · HIGH
- Vector
- CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N
- CVSS v4.0
- Not supplied
- EPSS
- 0.02124 · 81.8th percentile
- Weakness
- CWE-287 · Improper Authentication
- Published
- 2022-01-13T20:27Z
EPSS history
Timeline