CVE-2022-22992 - CVE House
Back to Database
Status published High CVE-2022-22992

Command Injection Remote Code Execution vulnerability on Western Digital My Cloud devices.

Vulnerability Description

A command injection remote code execution vulnerability was discovered on Western Digital My Cloud Devices that could allow an attacker to execute arbitrary system commands on the device. The vulnerability was addressed by escaping individual arguments to shell functions coming from user input.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2022-22992

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

  • Reported By: Sam Thomas (@_s_n_t) of Pentest Ltd (@pentestltd) working with Trend Micro’s Zero Day Initiative

References

More from westerndigital

View All →
CVE-2021-3310
Western Digital My Cloud OS 5 devices before 5.10.122 mishandle...
High 7.8
CVE-2021-36226
Western Digital My Cloud devices before OS5 do not use...
Unknown 0
CVE-2021-36225
Western Digital My Cloud devices before OS5 allow REST API...
Unknown 0
CVE-2021-36224
Western Digital My Cloud devices before OS5 have a nobody...
Critical 9.8
CVE-2021-35941
Western Digital WD My Book Live (2.x and later) and...
High 7.5

Affected Vendor

westerndigital

View all reports →

Affected Software

my cloud os
Vulnerable Versions:
0

Timeline

Official Publish: January 28th, 2022
Last Modified: August 3rd, 2024
Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.