CVE-2022-23000 - CVE House
Back to Database
Status published High CVE-2022-23000

Weak Default SSL use in Port Forwarding Service

Vulnerability Description

The Western Digital My Cloud Web App [https://os5.mycloud.com/] uses a weak SSLContext when attempting to configure port forwarding rules. This was enabled to maintain compatibility with old or outdated home routers. By using an "SSL" context instead of "TLS" or specifying stronger validation, deprecated or insecure protocols are permitted. As a result, a local user with no privileges can exploit this vulnerability and jeopardize the integrity, confidentiality and authenticity of information transmitted. The scope of impact cannot extend to other components and no user input is required to exploit this vulnerability.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2022-23000

Credits & Attribution

No credits recorded in the NVD database.

References

More from Western Digital

View All →
CVE-2025-30248
DLL hijacking in the WD Discovery Installer in Western Digital...
High 8.9
CVE-2025-30247
An OS command injection vulnerability in user interface in Western...
Critical 9.3
CVE-2024-22170
Unchecked buffer in Dynamic DNS client
Critical 9.2
CVE-2024-22169
Misconfiguration in node.js causing a code execution in WD Discovery
High 7.1
CVE-2024-22168
Cross-Site Scripting (XSS) vulnerability on Western Digital My Cloud and SanDisk ibi Web Apps
Medium 5.9

Affected Vendor

Western Digital

View all reports →

Affected Software

My Cloud
Vulnerable Versions:
My Cloud OS 5

Timeline

Official Publish: July 25th, 2022
Last Modified: August 3rd, 2024
Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L

Weaknesses (CWE)

CWE-757

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.