← Back

CVE-2022-29842

nvd nist
Published: May 10, 2023Modified: Nov 21, 2024

JSON object

Loading...
9.8
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Exploitability: 3.9 / Impact: 5.9
Source: NVD

Description

Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability that could allow an attacker to execute code in the context of the root user on a vulnerable CGI file was discovered in Western Digital My Cloud OS 5 devicesThis issue affects My Cloud OS 5: before 5.26.119.

Affected (1)

Westerndigital
1 product
My Cloud Os
Configuration A
1 vulnerable · 10 platform
Vulnerable SoftwareAffected Versions
My Cloud Os
From 5.02.104 to 5.26.119
Running on/withPlatform Versions
Westerndigital
My Cloud
All versions
Westerndigital
My Cloud Dl2100
All versions
Westerndigital
My Cloud Dl4100
All versions
Westerndigital
My Cloud Ex2100
All versions
Westerndigital
My Cloud Ex2 Ultra
All versions
Westerndigital
My Cloud Ex4100
All versions
Westerndigital
My Cloud Mirror G2
All versions
Westerndigital
My Cloud Pr2100
All versions
Westerndigital
My Cloud Pr4100
All versions
Westerndigital
Wd Cloud
All versions

Related CWEs

CWE-77
Improper Neutralization of Special Elements used in a Command ('Command Injection')
The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.

References (2)

Source: psirt@wdc.com
Vendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Vendor Advisory

Timeline

No history available yet.