CVE-2024-22169: Misconfiguration in node.js causing a code execution in WD Discovery
First published: Fri Aug 02 2024(Updated: )
WD Discovery versions prior to 5.0.589 contain a misconfiguration in the Node.js environment settings that could allow code execution by utilizing the 'ELECTRON_RUN_AS_NODE' environment variable. Any malicious application operating with standard user permissions can exploit this vulnerability, enabling code execution within WD Discovery application's context. WD Discovery version 5.0.589 addresses this issue by disabling certain features and fuses in Electron. The attack vector for this issue requires the victim to have the WD Discovery app installed on their device.
Credit: psirt@wdc.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Western Digital WD Discovery | <5.0.589 |
Remedy
Users can download the latest version from the WD Discovery Downloads page or by following the instructions on the WD Discovery: Online User Guide https://support-en.wd.com/app/answers/detailweb/a_id/20465
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2024-22169?
CVE-2024-22169 is classified as a high severity vulnerability due to its potential for code execution.
How do I fix CVE-2024-22169?
To mitigate CVE-2024-22169, users should upgrade WD Discovery to version 5.0.589 or later.
Who is affected by CVE-2024-22169?
CVE-2024-22169 affects users of WD Discovery versions prior to 5.0.589.
What types of attacks can exploit CVE-2024-22169?
CVE-2024-22169 can be exploited through malicious applications leveraging the 'ELECTRON_RUN_AS_NODE' environment variable.
Is CVE-2024-22169 specific to certain operating systems?
CVE-2024-22169 is primarily a concern for systems running WD Discovery with configurations that allow the exploitation of its Node.js environment.
- collector/mitre-cve
- source/MITRE
- agent/references
- agent/weakness
- agent/title
- agent/remedy
- agent/description
- agent/type
- agent/first-publish-date
- agent/severity
- agent/author
- agent/event
- collector/nvd-api
- source/NVD
- agent/last-modified-date
- agent/source
- agent/softwarecombine
- agent/tags
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/western digital
- canonical/western digital wd discovery