CVE-2022-22997: Command Injection Vulnerability on My Cloud Home

Q: What is CVE-2022-22997?

CVE-2022-22997 is a remote code execution vulnerability in My Cloud Home devices.

Q: How does CVE-2022-22997 work?

CVE-2022-22997 allows an attacker to execute unsigned code on My Cloud Home devices by exploiting a command injection vulnerability and accessing the AWS S3 bucket.

Q: How severe is CVE-2022-22997?

CVE-2022-22997 has a severity rating of 9.8, which is considered critical.

Q: Which software versions are affected by CVE-2022-22997?

My Cloud Home devices with firmware versions up to 8.5.1-102 are affected by CVE-2022-22997.

Q: How can I fix CVE-2022-22997?

To fix CVE-2022-22997, update your My Cloud Home device firmware to version 8.7.0-107 or later. Check the provided link for more information.

Published Jul 12, 2022

Updated

Addressed a remote code execution vulnerability by resolving a command injection vulnerability and closing an AWS S3 bucket that potentially allowed an attacker to execute unsigned code on My Cloud Home devices.

Affected Software

5 affected components

WesternDigital My Cloud Home Duo Firmware<8.5.1-102

WesternDigital My Cloud Home Duo

Linux Linux kernel

WesternDigital My Cloud Home Firmware<8.5.1-102

WesternDigital My Cloud Home

Remediation

Information

My Cloud Home devices have been automatically updated to resolve this vulnerability

Event History

Jul 12, 2022

CVE Published

via MITRE·08:22 PM

Data Sourced

via MITRE·08:22 PM

RemedyDescriptionSeverityWeakness

Frequently Asked Questions

What is CVE-2022-22997?

CVE-2022-22997 is a remote code execution vulnerability in My Cloud Home devices.

How does CVE-2022-22997 work?

CVE-2022-22997 allows an attacker to execute unsigned code on My Cloud Home devices by exploiting a command injection vulnerability and accessing the AWS S3 bucket.

How severe is CVE-2022-22997?