CVE-2022-22989: Pre-authenticated stack overflow vulnerability on FTP Service
Published Jan 13, 2022
·Updated
My Cloud OS 5 was vulnerable to a pre-authenticated stack overflow vulnerability on the FTP service that could be exploited by unauthenticated attackers on the network. Addressed the vulnerability by adding defenses against stack overflow issues.
Affected Software
22 affected components
WesternDigital My Cloud Os<5.19.117
WesternDigital My Cloud
WesternDigital My Cloud Dl2100
WesternDigital My Cloud Dl4100
WesternDigital My Cloud Ex2 Ultra
WesternDigital My Cloud Ex2100
WesternDigital My Cloud Ex4100
WesternDigital My Cloud Mirror Gen 2
WesternDigital My Cloud Pr2100
WesternDigital My Cloud Pr4100
WesternDigital Wd Cloud
All of the following
WesternDigital My Cloud Os<5.19.117
Any of the following
WesternDigital My Cloud
WesternDigital My Cloud Dl2100
WesternDigital My Cloud Dl4100
WesternDigital My Cloud Ex2 Ultra
WesternDigital My Cloud Ex2100
WesternDigital My Cloud Ex4100
WesternDigital My Cloud Mirror Gen 2
WesternDigital My Cloud Pr2100
WesternDigital My Cloud Pr4100
WesternDigital Wd Cloud
Remediation
Information
Update your My Cloud device to firmware version 5.19.117.
Event History
Jan 13, 2022
CVE Published
via MITRE·08:27 PM
Data Sourced
via MITRE·08:27 PM
RemedyDescriptionSeverityWeakness
Data Sourced
via NVD·09:15 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the vulnerability ID for this issue?
The vulnerability ID for this issue is CVE-2022-22989.
2
What is the severity of CVE-2022-22989?
The severity of CVE-2022-22989 is critical with a CVSS score of 9.8.
3
Which software versions are affected by CVE-2022-22989?
My Cloud OS 5 versions up to and excluding 5.19.117 are affected by CVE-2022-22989.
4
How can the vulnerability be exploited?
CVE-2022-22989 can be exploited by unauthenticated attackers on the network.
5
What has been done to address the vulnerability?
The vulnerability has been addressed by adding defenses against stack overflow issues.