CVE-2022-29843
moderate-risk
Published 2023-01-26
A command injection vulnerability in the DDNS service configuration of Western Digital My Cloud OS 5 devices running firmware versions prior to 5.26.119 allows an attacker to execute code in the context of the root user.
Do I need to act?
-
0.90% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
6
CVSS 6.2/10
Medium
LOCAL
/ LOW complexity
Affected Products (8)
My Cloud Pr2100 Firmware
My Cloud Ex4100 Firmware
My Cloud Ex2 Ultra Firmware
My Cloud Mirror G2 Firmware
My Cloud Dl2100 Firmware
My Cloud Dl4100 Firmware
My Cloud Ex2100 Firmware
Affected Vendors
References (2)
37
/ 100
moderate-risk
Severity
20/34 · Moderate
Exploitability
3/34 · Minimal
Exposure
14/34 · Moderate