Public exploit available
Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).
CVE-2022-29844 — Relative Path Traversal in Digital MY Cloud
Severity
9.8CRITICALNVD
EPSS
58.4%
top 1.79%
CISA KEV
Not in KEV
Exploit
PoC available
Public exploit / PoC exists
Affected products
Timeline
PublishedJan 26
Latest updateApr 20
Description
A vulnerability in the FTP service of Western Digital My Cloud OS 5 devices running firmware versions prior to 5.26.119 allows an attacker to read and write arbitrary files. This could lead to a full NAS compromise and would give remote execution capabilities to the attacker.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9
Affected Packages9 packages
🔴Vulnerability Details
1GHSA▶
GHSA-6r45-66xq-p89w: A vulnerability in the FTP service of Western Digital My Cloud OS 5 devices running firmware versions prior to 5↗2023-01-26
💥Exploits & PoCs
1Nuclei▶
WD My Cloud Panel - Detect