Advisories · Technology

Western Digital My Cloud.

Every CVE that names Western Digital My Cloud among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2025-30247 CVE record

CVSS 9.3 CriticalCritical · CVSS 9+

OS command injection in Western Digital My Cloud
- Western Digital My Cloud
- Command injection
Not analysed yet 29 Sept 2025
CVE-2024-22170 CVE record

CVSS 9.2 CriticalCritical · CVSS 9+

Unchecked buffer in Dynamic DNS client
- Western Digital My Cloud
- Memory corruption
Not analysed yet 27 Sept 2024
CVE-2022-29844 CVE record

CVSS 6.7 Medium

Western Digital My Cloud OS 5 arbitrary file read and write vulnerability via ftp
- Western Digital My Cloud
- Path traversal
Not analysed yet 25 Jan 2023
CVE-2022-29843 CVE record

CVSS 6.2 Medium

Western Digital My Cloud OS 5 devices Command Injection Vulnerability
- Western Digital My Cloud
- Command injection
Not analysed yet 25 Jan 2023
CVE-2022-29839 CVE record

CVSS 4.1 Medium

Remote Backups Application Discloses Stored Credentials
- Western Digital My Cloud
- Hard-coded credentials
Not analysed yet 9 Dec 2022
CVE-2022-29838 CVE record

CVSS 4.3 Medium

Authentication issue with the encrypted volumes and auto mount feature in My Cloud devices
- Western Digital My Cloud
- Authentication bypass
Not analysed yet 9 Dec 2022
CVE-2022-22999 CVE record

CVSS 8.2 High

Cross-site Scripting Vulnerability in USB Backups App
- Western Digital My Cloud
- Cross-site scripting (XSS)
Not analysed yet 25 Jul 2022
CVE-2022-23000 CVE record

CVSS 7.3 High

Weak Default SSL use in Port Forwarding Service
- Western Digital My Cloud
- CWE-757
Not analysed yet 25 Jul 2022
CVE-2022-22995 CVE record

CVSS 10.0 CriticalCritical · CVSS 9+

Western Digital My Cloud OS 5 and My Cloud Home Unauthenticated Arbitrary File Write Vulnerability in Netatalk
- Western Digital My Cloud
- Western Digital My Cloud Home
- Path traversal
Not analysed yet 25 Mar 2022
CVE-2022-22994 CVE record

CVSS 8.8 High

Insufficient Verification of Data Authenticity Remote Code Execution Vulnerability on Western Digital My Cloud devices.
- Western Digital My Cloud
- CWE-345
Not analysed yet 28 Jan 2022
CVE-2022-22993 CVE record

CVSS 7.8 High

Limited Server-Side Request Forgery vulnerability on Western Digital My Cloud devices.
- Western Digital My Cloud
- Server-side request forgery (SSRF)
Not analysed yet 28 Jan 2022
CVE-2022-22990 CVE record

CVSS 7.8 High

Limited authentication bypass vulnerability on Western Digital My Cloud devices
- Western Digital My Cloud
- Authentication bypass
Not analysed yet 13 Jan 2022
CVE-2022-22991 CVE record

CVSS 7.8 High

Command injection through unsecured HTTP calls on Western Digital My Cloud devices
- Western Digital My Cloud
- Command injection
Not analysed yet 13 Jan 2022
CVE-2022-22989 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Pre-authenticated stack overflow vulnerability on FTP Service
- Western Digital My Cloud
- Memory corruption
Not analysed yet 13 Jan 2022