CVE-2022-22994

{"id": "CVE-2022-22994", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 7.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Secondary", "source": "psirt@wdc.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "published": "2022-01-28T20:15:12.813", "references": [{"url": "https://www.westerndigital.com/support/product-security/wdc-22002-my-cloud-os5-firmware-5-19-117", "tags": ["Release Notes", "Vendor Advisory"], "source": "psirt@wdc.com"}, {"url": "https://www.zerodayinitiative.com/advisories/ZDI-22-349/", "tags": ["Third Party Advisory", "VDB Entry"], "source": "psirt@wdc.com"}, {"url": "https://www.westerndigital.com/support/product-security/wdc-22002-my-cloud-os5-firmware-5-19-117", "tags": ["Release Notes", "Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://www.zerodayinitiative.com/advisories/ZDI-22-349/", "tags": ["Third Party Advisory", "VDB Entry"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "psirt@wdc.com", "description": [{"lang": "en", "value": "CWE-345"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-345"}]}], "descriptions": [{"lang": "en", "value": "A remote code execution vulnerability was discovered on Western Digital My Cloud devices where an attacker could trick a NAS device into loading through an unsecured HTTP call. This was a result insufficient verification of calls to the device. The vulnerability was addressed by disabling checks for internet connectivity using HTTP."}, {"lang": "es", "value": "Se ha detectado una vulnerabilidad de ejecuci\u00f3n de c\u00f3digo remota en los dispositivos My Cloud de Western Digital donde un atacante pod\u00eda enga\u00f1ar a un dispositivo NAS para cargar mediante una llamada HTTP no segura. Esto era el resultado de una verificaci\u00f3n insuficiente de las llamadas al dispositivo. La vulnerabilidad fue abordada al deshabilitar la comprobaci\u00f3n de la conectividad a Internet mediante HTTP"}], "lastModified": "2024-11-21T06:47:45.907", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:westerndigital:my_cloud_os:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9B585AE9-1F28-42D7-B16D-75BF1CB8A054", "versionEndExcluding": "5.19.117"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:westerndigital:my_cloud:-:*:*:*:-:*:*:*", "vulnerable": false, "matchCriteriaId": "F597DB20-7E49-4234-AB58-B944E6D3F9EA"}, {"criteria": "cpe:2.3:h:westerndigital:my_cloud_dl2100:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "9E783EBC-7608-4527-B1AD-9B4E7A7A108C"}, {"criteria": "cpe:2.3:h:westerndigital:my_cloud_dl4100:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "F3034F4A-239C-4E38-9BD6-217361A7C519"}, {"criteria": "cpe:2.3:h:westerndigital:my_cloud_ex2_ultra:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "5A581EBA-A1F2-4ABC-8183-29973A46FA43"}, {"criteria": "cpe:2.3:h:westerndigital:my_cloud_ex2100:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "ABBBDC1E-2320-4767-B669-1BB2FFB1E1C4"}, {"criteria": "cpe:2.3:h:westerndigital:my_cloud_ex4100:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "B78030F0-6655-4604-9D16-2FA1F3FD52FF"}, {"criteria": "cpe:2.3:h:westerndigital:my_cloud_mirror_gen_2:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "5695E842-1561-4A4F-901F-6EC07F558989"}, {"criteria": "cpe:2.3:h:westerndigital:my_cloud_pr2100:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "BF58260B-2131-402C-A9DA-67B188136DE1"}, {"criteria": "cpe:2.3:h:westerndigital:my_cloud_pr4100:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "CB0C2FD9-4792-4DA2-9698-E53109A499EC"}, {"criteria": "cpe:2.3:h:westerndigital:wd_cloud:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "8FDE0337-4329-4CE3-9B0B-61BE8361E910"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "psirt@wdc.com"}