Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability that was caused by a command that read files from a privileged location and created a system command without sanitizing the read data. This command could be triggered by an attacker remotely to cause code execution and gain a reverse shell in Western Digital My Cloud OS 5 devices.This issue affects My Cloud OS 5: before 5.26.119.
References
| Link | Resource |
|---|---|
| https://www.westerndigital.com/support/product-security/wdc-23002-my-cloud-firmware-version-5-26-119 | Vendor Advisory |
Configurations
Configuration 1 (hide)
| AND |
|
History
22 May 2023, 18:06
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:h:westerndigital:my_cloud_ex2100:-:*:*:*:*:*:*:* cpe:2.3:h:westerndigital:my_cloud_pr4100:-:*:*:*:*:*:*:* cpe:2.3:h:westerndigital:my_cloud_pr2100:-:*:*:*:*:*:*:* cpe:2.3:o:westerndigital:my_cloud_os:*:*:*:*:*:*:*:* cpe:2.3:h:westerndigital:my_cloud_ex2_ultra:-:*:*:*:*:*:*:* cpe:2.3:h:westerndigital:my_cloud_mirror_g2:-:*:*:*:*:*:*:* cpe:2.3:h:westerndigital:my_cloud_ex4100:-:*:*:*:*:*:*:* cpe:2.3:h:westerndigital:my_cloud:-:*:*:*:*:*:*:* cpe:2.3:h:westerndigital:my_cloud_dl2100:-:*:*:*:*:*:*:* cpe:2.3:h:westerndigital:wd_cloud:-:*:*:*:*:*:*:* cpe:2.3:h:westerndigital:my_cloud_dl4100:-:*:*:*:*:*:*:* |
|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 9.8 |
| CWE | CWE-78 | |
| References | (MISC) https://www.westerndigital.com/support/product-security/wdc-23002-my-cloud-firmware-version-5-26-119 - Vendor Advisory |
10 May 2023, 22:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2023-05-10 22:15
Updated : 2024-02-04 23:37
NVD link : CVE-2022-29841
Mitre link : CVE-2022-29841
CVE.ORG link : CVE-2022-29841
JSON object : View
Products Affected
westerndigital
- my_cloud_dl2100
- my_cloud_ex2100
- my_cloud
- my_cloud_ex2_ultra
- my_cloud_pr4100
- my_cloud_pr2100
- my_cloud_mirror_g2
- my_cloud_ex4100
- wd_cloud
- my_cloud_dl4100
- my_cloud_os
CWE
CWE-78
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')