CVE-2022-22992

Command Injection Remote Code Execution vulnerability on Western Digital My Cloud devices.

High · published January 28, 2022

CVSS v3.1
7.8
EPSS
2%
Percentile
83.2
In the wild
Unconfirmed
What it is

A command injection remote code execution vulnerability was discovered on Western Digital My Cloud Devices that could allow an attacker to execute arbitrary system commands on the device. The vulnerability was addressed by escaping individual arguments to shell functions coming from user input.

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.02309 · 83.2th percentile
Published
2022-01-28T19:35Z
EPSS history
Timeline
  • 28 JAN 19:35Z
    Command Injection Remote Code Execution vulnerability on Western Digital My Cloud devices.
    cvelistv5