https://vulnogram.org/ Most recent CVEs assigned by Western Digital (wdc_psirt). https://vulnogram.org/seaview/icons/wdc_psirt.png https://vulnogram.org/ Wed, 21 Oct 2026 07:00:07 GMT https://vulnogram.org/CVE-2025-30248 https://vulnogram.org/CVE-2025-30248 DLL hijacking in the WD Discovery Installer in Western Digital WD Discovery 5.2.730 on Windows allows a local attacker to execute arbitrary code via placement of a crafted dll in the installer's search path. High Network Exploitable Mon, 26 Jan 2026 22:47:58 GMT https://vulnogram.org/CVE-2025-30247 https://vulnogram.org/CVE-2025-30247 An OS command injection vulnerability in user interface in Western Digital My Cloud firmware prior to 5.31.108 on NAS platforms allows remote attackers to execute arbitrary system commands via a specially crafted HTTP POST. Critical Network Exploitable Mon, 29 Sep 2025 21:07:20 GMT https://vulnogram.org/CVE-2024-22170 https://vulnogram.org/CVE-2024-22170 Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in Western Digital My Cloud ddns-start on Linux allows Overflow Buffers.This issue affects My Cloud: before 5.29.102. Critical Network Exploitable Fri, 27 Sep 2024 17:06:39 GMT https://vulnogram.org/CVE-2024-22169 https://vulnogram.org/CVE-2024-22169 WD Discovery versions prior to 5.0.589 contain a misconfiguration in the Node.js environment settings that could allow code execution by utilizing the 'ELECTRON_RUN_AS_NODE' environment variable. Any malicious application operating with standard user… High Fri, 02 Aug 2024 18:31:11 GMT https://vulnogram.org/CVE-2024-22168 https://vulnogram.org/CVE-2024-22168 A Cross-Site Scripting (XSS) vulnerability on the My Cloud, My Cloud Home, SanDisk ibi, and WD Cloud web apps was found which could allow an attacker to redirect the user to a crafted domain and reset their credentials, or to execute arbitrary client… Medium Network Exploitable Mon, 24 Jun 2024 22:54:16 GMT https://vulnogram.org/CVE-2024-22167 https://vulnogram.org/CVE-2024-22167 A potential DLL hijacking vulnerability in the SanDisk PrivateAccess application for Windows that could lead to arbitrary code execution in the context of the system user. This vulnerability is only exploitable locally if an attacker has access to a… High Wed, 13 Mar 2024 20:43:06 GMT https://vulnogram.org/CVE-2023-22819 https://vulnogram.org/CVE-2023-22819 An uncontrolled resource consumption vulnerability issue that could arise by sending crafted requests to a service to consume a large amount of memory, eventually resulting in the service being stopped and restarted was discovered in Western Digital… Medium Mon, 05 Feb 2024 21:26:53 GMT https://vulnogram.org/CVE-2023-22817 https://vulnogram.org/CVE-2023-22817 Server-side request forgery (SSRF) vulnerability that could allow a rogue server on the local network to modify its URL using another DNS address to point back to the loopback adapter. This could then allow the URL to exploit other vulnerabilities on… Medium Mon, 05 Feb 2024 21:26:42 GMT https://vulnogram.org/CVE-2023-22818 https://vulnogram.org/CVE-2023-22818 Multiple DLL Search Order Hijack vulnerabilities were addressed in the SanDisk Security Installer for Windows that could allow attackers with local access to execute arbitrary code by executing the installer in the same folder as the malicious DLL. T… High Wed, 15 Nov 2023 20:03:57 GMT https://vulnogram.org/CVE-2023-22814 https://vulnogram.org/CVE-2023-22814 An authentication bypass issue via spoofing was discovered in the token-based authentication mechanism that could allow an attacker to carry out an impersonation attack. This issue affects My Cloud OS 5 devices: before 5.26.202. Critical Network Exploitable Fri, 30 Jun 2023 23:05:43 GMT https://vulnogram.org/CVE-2023-22815 https://vulnogram.org/CVE-2023-22815 Post-authentication remote command injection vulnerability in Western Digital My Cloud OS 5 devices that could allow an attacker to execute code in the context of the root user on vulnerable CGI files. This vulnerability can only be exploited over th… Medium Fri, 30 Jun 2023 21:07:36 GMT https://vulnogram.org/CVE-2023-22816 https://vulnogram.org/CVE-2023-22816 A post-authentication remote command injection vulnerability in a CGI file in Western Digital My Cloud OS 5 devices that could allow an attacker to build files with redirects and execute larger payloads. This issue affects My Cloud OS 5 devices: befo… Medium Fri, 30 Jun 2023 21:01:16 GMT https://vulnogram.org/CVE-2022-36331 https://vulnogram.org/CVE-2022-36331 Western Digital My Cloud, My Cloud Home, My Cloud Home Duo, and SanDisk ibi devices were vulnerable to an impersonation attack that could allow an unauthenticated attacker to gain access to user data. This issue affects My Cloud OS 5 devices: before… Critical Network Exploitable Mon, 12 Jun 2023 17:57:51 GMT https://vulnogram.org/CVE-2022-36328 https://vulnogram.org/CVE-2022-36328 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could allow an attacker to create arbitrary shares on arbitrary directories and exfiltrate sensitive files, passwords, users and device configurations w… Medium Thu, 18 May 2023 17:55:02 GMT https://vulnogram.org/CVE-2022-36327 https://vulnogram.org/CVE-2022-36327 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could allow an attacker to write files to locations with certain critical filesystem types leading to remote code execution was discovered in Western Di… Medium Thu, 18 May 2023 17:54:39 GMT https://vulnogram.org/CVE-2022-36326 https://vulnogram.org/CVE-2022-36326 An uncontrolled resource consumption vulnerability issue that could arise by sending crafted requests to a service to consume a large amount of memory, eventually resulting in the service being stopped and restarted was discovered in Western Digital… Medium Thu, 18 May 2023 17:53:21 GMT https://vulnogram.org/CVE-2022-29840 https://vulnogram.org/CVE-2022-29840 Server-Side Request Forgery (SSRF) vulnerability that could allow a rogue server on the local network to modify its URL to point back to the loopback adapter was addressed in Western Digital My Cloud OS 5 devices. This could allow the URL to exploit… Medium Wed, 10 May 2023 22:09:28 GMT https://vulnogram.org/CVE-2022-29841 https://vulnogram.org/CVE-2022-29841 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability that was caused by a command that read files from a privileged location and created a system command without sanitizing the read data. This comma… High Wed, 10 May 2023 21:04:49 GMT https://vulnogram.org/CVE-2022-29842 https://vulnogram.org/CVE-2022-29842 Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability that could allow an attacker to execute code in the context of the root user on a vulnerable CGI file was discovered in Western Digital My Cloud OS 5 de… Critical Network Exploitable Wed, 10 May 2023 20:53:19 GMT https://vulnogram.org/CVE-2022-36329 https://vulnogram.org/CVE-2022-36329 An improper privilege management issue that could allow an attacker to cause a denial of service over the OTA mechanism was discovered in Western Digital My Cloud Home, My Cloud Home Duo and SanDisk ibi devices.This issue affects My Cloud Home and My… Medium Wed, 10 May 2023 19:23:29 GMT https://vulnogram.org/CVE-2022-36330 https://vulnogram.org/CVE-2022-36330 A buffer overflow vulnerability was discovered on firmware version validation that could lead to an unauthenticated remote code execution in Western Digital My Cloud Home, My Cloud Home Duo and SanDisk ibi devices. An attacker would require exploitat… Low Tue, 09 May 2023 23:16:03 GMT https://vulnogram.org/CVE-2023-22813 https://vulnogram.org/CVE-2023-22813 A device API endpoint was missing access controls on Western Digital My Cloud OS 5 iOS and Anroid Mobile Apps, My Cloud Home iOS and Android Mobile Apps, SanDisk ibi iOS and Android Mobile Apps, My Cloud OS 5 Web App, My Cloud Home Web App and the Sa… Low Mon, 08 May 2023 22:56:49 GMT https://vulnogram.org/CVE-2023-22812 https://vulnogram.org/CVE-2023-22812 SanDisk PrivateAccess versions prior to 6.4.9 support insecure TLS 1.0 and TLS 1.1 protocols which are susceptible to man-in-the-middle attacks thereby compromising confidentiality and integrity of data. High Network Exploitable Fri, 24 Mar 2023 00:00:00 GMT https://vulnogram.org/CVE-2022-29844 https://vulnogram.org/CVE-2022-29844 A vulnerability in the FTP service of Western Digital My Cloud OS 5 devices running firmware versions prior to 5.26.119 allows an attacker to read and write arbitrary files. This could lead to a full NAS compromise and would give remote execution cap… Medium Wed, 25 Jan 2023 00:00:00 GMT https://vulnogram.org/CVE-2022-29843 https://vulnogram.org/CVE-2022-29843 A command injection vulnerability in the DDNS service configuration of Western Digital My Cloud OS 5 devices running firmware versions prior to 5.26.119 allows an attacker to execute code in the context of the root user. Medium Wed, 25 Jan 2023 00:00:00 GMT https://vulnogram.org/CVE-2022-23005 https://vulnogram.org/CVE-2022-23005 Western Digital has identified a weakness in the UFS standard that could result in a security vulnerability. This vulnerability may exist in some systems where the Host boot ROM code implements the UFS Boot feature to boot from UFS compliant storage… High Mon, 23 Jan 2023 00:00:00 GMT https://vulnogram.org/CVE-2022-29839 https://vulnogram.org/CVE-2022-29839 Insufficiently Protected Credentials vulnerability in the remote backups application on Western Digital My Cloud devices that could allow an attacker who has gained access to a relevant endpoint to use that information to access protected data. This… Medium Fri, 09 Dec 2022 00:00:00 GMT https://vulnogram.org/CVE-2022-29838 https://vulnogram.org/CVE-2022-29838 Improper Authentication vulnerability in the encrypted volumes and auto mount features of Western Digital My Cloud devices allows insecure direct access to the drive information in the case of a device reset. This issue affects: Western Digital My Cl… Medium Fri, 09 Dec 2022 00:00:00 GMT https://vulnogram.org/CVE-2022-29837 https://vulnogram.org/CVE-2022-29837 A path traversal vulnerability was addressed in Western Digital My Cloud Home, My Cloud Home Duo and SanDisk ibi which could allow an attacker to initiate installation of custom ZIP packages and overwrite system files. This could potentially lead to… Medium Thu, 01 Dec 2022 00:00:00 GMT https://vulnogram.org/CVE-2022-29836 https://vulnogram.org/CVE-2022-29836 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability was discovered via an HTTP API on Western Digital My Cloud Home; My Cloud Home Duo; and SanDisk ibi devices that could allow an attacker to abuse certain par… Low Wed, 09 Nov 2022 00:00:00 GMT https://vulnogram.org/CVE-2022-23006 https://vulnogram.org/CVE-2022-23006 A stack-based buffer overflow vulnerability was found on Western Digital My Cloud Home, My Cloud Home Duo, and SanDisk ibi that could allow an attacker accessing the system locally to read information from /etc/version file. This vulnerability can on… Low Tue, 27 Sep 2022 13:53:29 GMT https://vulnogram.org/CVE-2022-29835 https://vulnogram.org/CVE-2022-29835 WD Discovery software executable files were signed with an unsafe SHA-1 hashing algorithm. An attacker could use this weakness to create forged certificate signatures due to the use of a hashing algorithm that is not collision-free. This could thereb… Medium Network Exploitable Mon, 19 Sep 2022 19:43:53 GMT https://vulnogram.org/CVE-2022-23004 https://vulnogram.org/CVE-2022-23004 When computing a shared secret or point multiplication on the NIST P-256 curve using a public key with an X coordinate of zero, an error is returned from the library, and an invalid unreduced value is written to the output buffer. This may be leverag… Medium Network Exploitable Fri, 29 Jul 2022 18:55:55 GMT https://vulnogram.org/CVE-2022-23003 https://vulnogram.org/CVE-2022-23003 When computing a shared secret or point multiplication on the NIST P-256 curve that results in an X coordinate of zero, the resulting output is not properly reduced modulo the P-256 field prime and is invalid. The resulting output may cause an error… Medium Network Exploitable Fri, 29 Jul 2022 18:54:29 GMT https://vulnogram.org/CVE-2022-23002 https://vulnogram.org/CVE-2022-23002 When compressing or decompressing a point on the NIST P-256 elliptic curve with an X coordinate of zero, the resulting output is not properly reduced modulo the P-256 field prime and is invalid. The resulting output will cause an error when used in o… Medium Network Exploitable Fri, 29 Jul 2022 18:52:44 GMT https://vulnogram.org/CVE-2022-23001 https://vulnogram.org/CVE-2022-23001 When compressing or decompressing elliptic curve points using the Sweet B library, an incorrect choice of sign bit is used. An attacker with user level privileges and no other user's assistance can exploit this vulnerability with only knowledge of th… Medium Network Exploitable Fri, 29 Jul 2022 18:51:26 GMT https://vulnogram.org/CVE-2022-22999 https://vulnogram.org/CVE-2022-22999 Western Digital My Cloud devices are vulnerable to a cross side scripting vulnerability that can allow a malicious user with elevated privileges access to drives being backed up to construct and inject JavaScript payloads into an authenticated user's… High Mon, 25 Jul 2022 18:47:36 GMT https://vulnogram.org/CVE-2022-23000 https://vulnogram.org/CVE-2022-23000 The Western Digital My Cloud Web App [https://os5.mycloud.com/] uses a weak SSLContext when attempting to configure port forwarding rules. This was enabled to maintain compatibility with old or outdated home routers. By using an "SSL" context instead… High Mon, 25 Jul 2022 18:46:02 GMT https://vulnogram.org/CVE-2022-22997 https://vulnogram.org/CVE-2022-22997 Addressed a remote code execution vulnerability by resolving a command injection vulnerability and closing an AWS S3 bucket that potentially allowed an attacker to execute unsigned code on My Cloud Home devices. Medium Tue, 12 Jul 2022 20:22:36 GMT https://vulnogram.org/CVE-2022-22998 https://vulnogram.org/CVE-2022-22998 Implemented protections on AWS credentials that were not properly protected. High Tue, 12 Jul 2022 20:19:34 GMT https://vulnogram.org/CVE-2022-22996 https://vulnogram.org/CVE-2022-22996 The G-RAID 4/8 Software Utility setups for Windows were affected by a DLL hijacking vulnerability. Successful exploitation could lead to arbitrary code execution in the context of the system user. High Wed, 30 Mar 2022 16:03:01 GMT https://vulnogram.org/CVE-2022-22995 https://vulnogram.org/CVE-2022-22995 The combination of primitives offered by SMB and AFP in their default configuration allows the arbitrary writing of files. By exploiting these combination of primitives, an attacker can execute arbitrary code. Critical Network Exploitable Fri, 25 Mar 2022 00:00:00 GMT https://vulnogram.org/CVE-2022-22994 https://vulnogram.org/CVE-2022-22994 A remote code execution vulnerability was discovered on Western Digital My Cloud devices where an attacker could trick a NAS device into loading through an unsecured HTTP call. This was a result insufficient verification of calls to the device. The v… High Fri, 28 Jan 2022 19:35:05 GMT https://vulnogram.org/CVE-2022-22992 https://vulnogram.org/CVE-2022-22992 A command injection remote code execution vulnerability was discovered on Western Digital My Cloud Devices that could allow an attacker to execute arbitrary system commands on the device. The vulnerability was addressed by escaping individual argumen… High Fri, 28 Jan 2022 19:35:04 GMT https://vulnogram.org/CVE-2022-22993 https://vulnogram.org/CVE-2022-22993 A limited SSRF vulnerability was discovered on Western Digital My Cloud devices that could allow an attacker to impersonate a server and reach any page on the server by bypassing access controls. The vulnerability was addressed by creating a whitelis… High Fri, 28 Jan 2022 19:09:29 GMT https://vulnogram.org/CVE-2022-22988 https://vulnogram.org/CVE-2022-22988 File and directory permissions have been corrected to prevent unintended users from modifying or accessing resources. It would be more difficult for an authenticated attacker to now traverse through the files and directories. This can only be exploit… High Thu, 13 Jan 2022 20:27:27 GMT https://vulnogram.org/CVE-2022-22990 https://vulnogram.org/CVE-2022-22990 A limited authentication bypass vulnerability was discovered that could allow an attacker to achieve remote code execution and escalate privileges on the My Cloud devices. Addressed this vulnerability by changing access token validation logic and rew… High Thu, 13 Jan 2022 20:27:26 GMT https://vulnogram.org/CVE-2022-22991 https://vulnogram.org/CVE-2022-22991 A malicious user on the same LAN could use DNS spoofing followed by a command injection attack to trick a NAS device into loading through an unsecured HTTP call. Addressed this vulnerability by disabling checks for internet connectivity using HTTP. High Thu, 13 Jan 2022 20:27:25 GMT https://vulnogram.org/CVE-2022-22989 https://vulnogram.org/CVE-2022-22989 My Cloud OS 5 was vulnerable to a pre-authenticated stack overflow vulnerability on the FTP service that could be exploited by unauthenticated attackers on the network. Addressed the vulnerability by adding defenses against stack overflow issues. Critical Network Exploitable Thu, 13 Jan 2022 20:27:24 GMT