CVE-2022-22990CWE-287

Limited authentication bypass vulnerability on Western Digital My Cloud devices

High · published January 13, 2022

CVSS v3.1
7.8
EPSS
2%
Percentile
81.8
In the wild
Unconfirmed
What it is

A limited authentication bypass vulnerability was discovered that could allow an attacker to achieve remote code execution and escalate privileges on the My Cloud devices. Addressed this vulnerability by changing access token validation logic and rewriting rule logic on PHP scripts.

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.02124 · 81.8th percentile
Weakness
CWE-287 · Improper Authentication
Published
2022-01-13T20:27Z
EPSS history
Timeline
  • 13 JAN 20:27Z
    Limited authentication bypass vulnerability on Western Digital My Cloud devices
    cvelistv5