CVE-2022-29842: Command Injection Vulnerability in Western Digital My Cloud devices
Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability that could allow an attacker to execute code in the context of the root user on a vulnerable CGI file was discovered in Western Digital My Cloud OS 5 devicesThis issue affects My Cloud OS 5: before 5.26.119.
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is CVE-2022-29842?
CVE-2022-29842 is an improper neutralization of special elements used in a command (command injection) vulnerability in Western Digital My Cloud OS 5 devices.
What is the severity of CVE-2022-29842?
The severity of CVE-2022-29842 is critical with a CVSS score of 9.8.
Which software is affected by CVE-2022-29842?
CVE-2022-29842 affects Western Digital My Cloud OS 5 devices before version 5.26.119.
How can an attacker exploit CVE-2022-29842?
An attacker can exploit CVE-2022-29842 by executing code in the context of the root user on a vulnerable CGI file.
How can I fix CVE-2022-29842?
To fix CVE-2022-29842, update Western Digital My Cloud OS 5 devices to version 5.26.119 or later.