CVE-2022-22994

A remote code execution vulnerability was discovered on Western Digital My Cloud devices where an attacker could trick a NAS device into loading through an unsecured HTTP call. This was a result insufficient verification of calls to the device. The vulnerability was addressed by disabling checks for internet connectivity using HTTP.

• CWE-345
• CWE-345

• https://www.westerndigital.com/support/product-security/wdc-22002-my-cloud-os5-firmware-5-19-117Release Notes, Vendor Advisory
• https://www.zerodayinitiative.com/advisories/ZDI-22-349/Third Party Advisory, VDB Entry
• https://www.westerndigital.com/support/product-security/wdc-22002-my-cloud-os5-firmware-5-19-117Release Notes, Vendor Advisory
• https://www.zerodayinitiative.com/advisories/ZDI-22-349/Third Party Advisory, VDB Entry

Published

Jan 28, 2022

Last Modified

Jun 17, 2026

Status

Modified

• Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-22989My Cloud OS 5 was vulnerable to a pre-authenticated stack ov…9.8
• CVE-2022-2299The Allow SVG Files WordPress plugin through 1.1 does not sa…5.4
• CVE-2022-22990A limited authentication bypass vulnerability was discovered…8.8
• CVE-2022-22991A malicious user on the same LAN could use DNS spoofing foll…8.8
• CVE-2022-22992A command injection remote code execution vulnerability was …9.8
• CVE-2022-22993A limited SSRF vulnerability was discovered on Western Digit…8.8
• CVE-2022-22995The combination of primitives offered by SMB and AFP in thei…9.8
• CVE-2022-22996The G-RAID 4/8 Software Utility setups for Windows were affe…7.8
• CVE-2022-22997Addressed a remote code execution vulnerability by resolving…9.8
• CVE-2022-22998Implemented protections on AWS credentials that were not pro…7.5
• CVE-2022-22999Western Digital My Cloud devices are vulnerable to a cross s…4.8
• CVE-2022-2300Cross-site Scripting (XSS) - Stored in GitHub repository mic…5.4