CVE-2022-29844 - CVE House
Back to Database
Status published Medium CVE-2022-29844

Western Digital My Cloud OS 5 arbitrary file read and write vulnerability via ftp

Vulnerability Description

A vulnerability in the FTP service of Western Digital My Cloud OS 5 devices running firmware versions prior to 5.26.119 allows an attacker to read and write arbitrary files. This could lead to a full NAS compromise and would give remote execution capabilities to the attacker.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2022-29844

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

  • Luca MORO (@johncool__) - moro.luca@gmail.comworking with Trend Micro Zero Day Initiative

References

More from Western Digital

View All →
CVE-2025-30248
DLL hijacking in the WD Discovery Installer in Western Digital...
High 8.9
CVE-2025-30247
An OS command injection vulnerability in user interface in Western...
Critical 9.3
CVE-2024-22170
Unchecked buffer in Dynamic DNS client
Critical 9.2
CVE-2024-22169
Misconfiguration in node.js causing a code execution in WD Discovery
High 7.1
CVE-2024-22168
Cross-Site Scripting (XSS) vulnerability on Western Digital My Cloud and SanDisk ibi Web Apps
Medium 5.9

Affected Vendor

Western Digital

View all reports →

Affected Software

My Cloud
Vulnerable Versions:
My Cloud OS 5

Timeline

Official Publish: January 25th, 2023
Last Modified: April 4th, 2025
Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Weaknesses (CWE)

CWE-23

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application
Initial Access
T1005 Data from Local System
Collection
T1552 Unsecured Credentials
Credential Access
T1105 Ingress Tool Transfer
Command and Control
T1565 Data Manipulation
Impact