CVSS: 9.8EPSS: 0%CPEs: 16EXPL: 0CVE-2022-29844 – Western Digital My Cloud OS 5 arbitrary file read and write vulnerability via ftp
https://notcve.org/view.php?id=CVE-2022-29844
A vulnerability in the FTP service of Western Digital My Cloud OS 5 devices running firmware versions prior to 5.26.119 allows an attacker to read and write arbitrary files. This could lead to a full NAS compromise and would give remote execution capabilities to the attacker. Una vulnerabilidad en el servicio FTP de los dispositivos Western Digital My Cloud OS 5 que ejecutan versiones de firmware anteriores a la 5.26.119 permite a un atacante leer y escribir archivos arbitrarios. Esto podría provocar un compromiso total del NAS y proporcionaría capacidades de ejecución remota al atacante. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Western Digital MyCloud PR4100 NAS devices. • https://www.westerndigital.com/en-in/support/product-security/wdc-23002-my-cloud-firmware-version-5-26-119 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') CWE-23: Relative Path Traversal •
CVSS: 9.8EPSS: 0%CPEs: 16EXPL: 0CVE-2022-29843 – Western Digital My Cloud OS 5 devices Command Injection Vulnerability
https://notcve.org/view.php?id=CVE-2022-29843
A command injection vulnerability in the DDNS service configuration of Western Digital My Cloud OS 5 devices running firmware versions prior to 5.26.119 allows an attacker to execute code in the context of the root user. Una vulnerabilidad de inyección de comandos en la configuración del servicio DDNS de dispositivos Western Digital My Cloud OS 5 que ejecutan versiones de firmware anteriores a la 5.26.119 permite a un atacante ejecutar código en el contexto del usuario root. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Western Digital MyCloud PR4100. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of DDNS responses. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. • https://www.westerndigital.com/en-in/support/product-security/wdc-23002-my-cloud-firmware-version-5-26-119 • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 5.5EPSS: 0%CPEs: 12EXPL: 0CVE-2022-29839 – Remote Backups Application Discloses Stored Credentials
https://notcve.org/view.php?id=CVE-2022-29839
Insufficiently Protected Credentials vulnerability in the remote backups application on Western Digital My Cloud devices that could allow an attacker who has gained access to a relevant endpoint to use that information to access protected data. This issue affects: Western Digital My Cloud My Cloud versions prior to 5.25.124 on Linux. Vulnerabilidad de credenciales insuficientemente protegidas en la aplicación de copias de seguridad remotas en dispositivos Western Digital My Cloud que podría permitir que un atacante que haya obtenido acceso a un endpoint relevante use esa información para acceder a datos protegidos. Este problema afecta: Versiones de Western Digital My Cloud My Cloud anteriores a la 5.25.124 en Linux. • https://www.westerndigital.com/support/product-security/wdc-22019-my-cloud-firmware-version-5-25-124 • CWE-522: Insufficiently Protected Credentials •
CVSS: 4.6EPSS: 0%CPEs: 11EXPL: 0CVE-2022-29838 – Authentication issue with the encrypted volumes and auto mount feature in My Cloud devices
https://notcve.org/view.php?id=CVE-2022-29838
Improper Authentication vulnerability in the encrypted volumes and auto mount features of Western Digital My Cloud devices allows insecure direct access to the drive information in the case of a device reset. This issue affects: Western Digital My Cloud My Cloud versions prior to 5.25.124 on Linux. La vulnerabilidad de autenticación inadecuada en los volúmenes cifrados y las funciones de montaje automático de los dispositivos Western Digital My Cloud permite un acceso directo inseguro a la información de la unidad en el caso de un reinicio del dispositivo. Este problema afecta: Versiones de Western Digital My Cloud My Cloud anteriores a la 5.25.124 en Linux. • https://www.westerndigital.com/support/product-security/wdc-22019-my-cloud-firmware-version-5-25-124 • CWE-287: Improper Authentication •
CVSS: 8.2EPSS: 0%CPEs: 16EXPL: 0CVE-2022-22999 – Cross-site Scripting Vulnerability in USB Backups App
https://notcve.org/view.php?id=CVE-2022-22999
Western Digital My Cloud devices are vulnerable to a cross side scripting vulnerability that can allow a malicious user with elevated privileges access to drives being backed up to construct and inject JavaScript payloads into an authenticated user's browser. As a result, it may be possible to gain control over the authenticated session, steal data, modify settings, or redirect the user to malicious websites. The scope of impact can extend to other components. Los dispositivos My Cloud de Western Digital son susceptibles a una vulnerabilidad de tipo cross side scripting que puede permitir a un usuario malicioso con altos privilegios acceder a las unidades de las que está haciéndose una copia de seguridad para construir e inyectar cargas útiles de JavaScript en el navegador de un usuario autenticado. Como resultado, puede ser posible conseguir el control de la sesión autenticada, robar datos, modificar la configuración o redirigir al usuario a sitios web maliciosos. • https://www.westerndigital.com/support/product-security/wdc-22011-my-cloud-firmware-version-5-23-114 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •