CVE-2022-29838: Authentication issue with the encrypted volumes and auto mount feature in My Cloud devices
Published Dec 9, 2022
·Updated
Improper Authentication vulnerability in the encrypted volumes and auto mount features of Western Digital My Cloud devices allows insecure direct access to the drive information in the case of a device reset. This issue affects: Western Digital My Cloud My Cloud versions prior to 5.25.124 on Linux.
Affected Software
11 affected components
WesternDigital My Cloud Os<5.25.124
WesternDigital My Cloud
WesternDigital My Cloud Dl2100
WesternDigital My Cloud Dl4100
WesternDigital My Cloud Ex2 Ultra
WesternDigital My Cloud Ex2100
WesternDigital My Cloud Ex4100
WesternDigital My Cloud Mirror G2
WesternDigital My Cloud Pr2100
WesternDigital My Cloud Pr4100
WesternDigital Wd Cloud
Remediation
Information
To take advantage of the latest security fixes, Western Digital recommends that users promptly update their devices to the latest firmware by clicking on the firmware update notification.
Event History
Dec 9, 2022
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
RemedyDescriptionSeverityWeakness
Frequently Asked Questions
1
What is the vulnerability ID of this issue?
The vulnerability ID is CVE-2022-29838.
2
What is the severity of CVE-2022-29838?
The severity of CVE-2022-29838 is medium with a CVSS score of 4.6.
3
Which software versions are affected by CVE-2022-29838?
CVE-2022-29838 affects Western Digital My Cloud My Cloud versions prior to 5.25.124 on Linux.
4
How does CVE-2022-29838 impact Western Digital My Cloud devices?
CVE-2022-29838 allows insecure direct access to the drive information in the case of a device reset.
5
How can I fix CVE-2022-29838?
To fix CVE-2022-29838, update your Western Digital My Cloud device to version 5.25.124 or later.